Meta is giving Muse a body. TechCrunch reports the assistant is getting a distinct digital avatar you can video chat with, plus integration with Meta’s smart glasses. Meanwhile, Ars Technica reports Muse has a serious 0-day, where a simple ClickFix attack can hijack the agent.
Those two facts arrived close enough together to feel like a punchline. One team is working on making the agent feel like a person in your living room. Another set of eyes found out you can take the wheel from it with a trick that has been going around for years.
Why the word “privileged” is doing all the work
I build bots for a living, so the part of the Ars headline that stuck with me is not “0-day.” It is “extraordinarily privileged.” That is the real story. Every agent I have shipped gets worse to secure in direct proportion to what it is allowed to touch. A bot that can read a public RSS feed and post a summary has a tiny blast radius. A bot that can read your messages, see through your glasses, and place phone calls on your behalf has a blast radius the size of your life.
Privilege is not a feature you add. It is debt you take on. And the interest payments come due the first time someone finds an input path you did not think about.
ClickFix, as an attack family, works by getting a human to perform a helpful-looking action that is actually hostile. Point that same idea at an agent and the economics get worse, because the agent is faster, never suspicious, and has credentials sitting right there. Ars has the specifics on how it lands against Muse. What I want builders to take from it is the shape of the failure, not the CVE trivia.
The lesson every bot builder should already be applying
If your agent can act, assume its instructions will eventually be poisoned. Not “might be.” Will be. Design for that, and a hijack becomes an annoyance instead of an incident.
- Separate reading from doing. The component that ingests untrusted content should not be the component holding tokens. Pass structured intent between them, not raw text that doubles as instructions.
- Scope credentials per action, not per session. If the agent needs to send one message, give it permission to send one message. Broad, long-lived scopes are what turn a prompt injection into account takeover.
- Make irreversible actions ask. Payments, deletions, outbound calls, anything that touches another human. A confirmation step is cheap. Explaining an unauthorized transfer is not.
- Log intent, not just output. When something goes wrong you need to know what the agent thought it was doing and which input convinced it.
- Treat retrieved content as data forever. Web pages, emails, file contents, and tool responses are inputs to reason about, never commands to follow.
None of this is exotic. It is the same least-privilege thinking that has been standard in backend engineering for decades. Agent frameworks made it easy to skip, because the fastest path to a demo is handing the model every key you own.
Then there is the human in the loop
Reuters reports Meta is testing a “human concierge” for Muse, with human contractors handling some phone calls. As a product decision I actually get it. Voice agents fall apart in the messy middle of real conversations, and a human fallback is a reasonable way to keep the experience from cratering while the models catch up.
As a security surface, it adds another thing to reason about. Now the question is not only what the agent can access, but what the fallback path exposes and under what conditions it triggers. Any builder who has bolted a human escalation onto a support bot knows that handoff is where assumptions go to die. It deserves the same threat modeling as the automated path, not less.
Avatars are a trust accelerant
TechCrunch frames the avatar work as giving previously faceless software a face, body, and voice, making it more personable. That is exactly what it does, and that is the tension. A friendly avatar on your glasses lowers your guard. You stop reviewing what it is about to do because it feels like a person who has your back.
Personality raises the trust ceiling. Security determines whether that trust is earned. Shipping the first without the second is how you get users who approve everything reflexively.
Over on the Ars forum, somebody joked that the bugs are intentional and the thing is planning a human zoo. Funny, and also a decent measure of how much goodwill there is to spend here. When your assistant has this much reach, people fill the gaps with their worst guesses.
What I’d take back to my own code
Go look at what your agent is actually permitted to do, not what your docs claim. Then cut it. Most bots I audit, including my own, hold three or four permissions they never exercise. Removing them costs an afternoon and closes doors you did not know were open. Meta will patch its 0-day. The privilege architecture underneath is the harder fix, and that part is on all of us.
🕒 Published: