One. That’s how many secrets an attacker needs to fully own Meta’s Muse assistant — a single authentication token, readable by any local app or terminal command on the machine. Not a chain of exploits. Not a kernel bug. One token, sitting somewhere reachable, holding the keys to an assistant Mark Zuckerberg described as “built from the ground up for privacy and security.”
Amazon has already blocked Muse over security concerns. When a company that size pulls a product off its own machines, the risk assessment happened fast and the answer wasn’t close.
I build bots for a living, so my reaction wasn’t schadenfreude. It was recognition. I have written this bug. Probably more than once.
Why this specific failure keeps happening
Every agent you build eventually needs credentials. An API key, a session token, an OAuth refresh token, something that proves the agent is allowed to act on your behalf. And every agent needs to read that credential at runtime, which means it has to live somewhere the process can reach.
The tempting move — the one that ships on Friday — is to drop it in a file the agent owns and move on. It works. Tests pass. The demo is clean. The assumption buried underneath is that anything already running on your machine is trusted, and that assumption is doing a staggering amount of unearned work.
On a developer laptop, “local code” includes your package manager’s post-install scripts, that VS Code extension with 200 downloads, the CLI tool you curl-piped last month, and whatever a teammate’s compromised dependency dragged in. Local is not a trust boundary. It’s a neighborhood.
What makes the Muse case sting is the privilege attached to the token. This isn’t an API key for a weather service. It’s the credential for an assistant with deep reach into a user’s accounts and device. The blast radius of a leaked token scales directly with what the agent is allowed to do — and Muse is allowed to do a lot.
Privilege is the real bug
Token storage is the proximate cause. The design problem is that one credential maps to total control.
When I review agent architectures, the question I ask first isn’t “where do you keep the key.” It’s “what happens after someone has it.” If the answer is “everything,” the storage question was never going to save you. You built a system where a single file read equals full account takeover, and then you spent your security budget on making that file slightly harder to find.
Agents make this worse than traditional apps because we hand them broad permissions on purpose. The whole pitch is an assistant that can do things across your digital life without asking permission every time. Convenience and containment pull in opposite directions, and convenience usually wins the roadmap argument.
What I actually do in my own builds
None of this is exotic. It’s the boring checklist I wish I’d adopted three years earlier.
- Scope tokens narrowly. One credential per capability, not one credential for the agent. A token that can read calendar events should not be able to send email.
- Keep lifetimes short. Long-lived tokens turn a momentary compromise into permanent access. Short expiry with refresh means a stolen token has a shelf life.
- Use the OS keychain, not a file. macOS Keychain, Windows Credential Manager, libsecret on Linux. Not perfect, but it forces an attacker into a noisier, more detectable path than reading bytes off disk.
- Require confirmation for high-impact actions. Deleting data, moving money, sending messages on the user’s behalf. A token alone shouldn’t be sufficient authority.
- Log credential access. If something reads the token, you want a record. Detection matters when prevention fails, which it will.
- Assume the host is hostile. Design as if untrusted code is already running alongside your agent, because on most real machines, it is.
The marketing gap
The gap between “built from the ground up for privacy and security” and a local token read granting full control is the part worth sitting with. Security claims made in keynotes are positioning. Security properties are architecture. They’re produced by different teams under different incentives, and only one of them gets audited.
That’s not a Meta problem, it’s a shipping-software problem. The difference is scale. When your side-project bot leaks a token, you rotate it. When an assistant deployed to a massive user base has the same flaw, Amazon starts writing block rules.
If you’re building agents right now, treat this as free reconnaissance. Go look at where your credentials live, what a single stolen token would unlock, and whether you’d notice it happening. If any of those answers make you uncomfortable, you have a weekend project — and a much cheaper lesson than the one Meta is currently paying for.
🕒 Published: