Muse Has Phone Privileges and I Have Questions

It’s a Tuesday evening. You tell your assistant to call the tire shop across town and ask whether they have your size in stock. Thirty seconds later you get a summary: they do, and they close at seven. You never dialed. You never spoke. Somewhere in that chain, a call was placed on your behalf, your name was given to a stranger, and a decision was made about what to say next.

That’s Meta’s Muse, the personal AI agent the company debuted alongside its Muse Spark family. It runs on web, mobile apps, and WhatsApp, and Meta says it’s heading into the company’s AI glasses. It places phone calls. And according to a Reuters exclusive from September 22, Meta has been testing a “human concierge” setup where human contractors quietly handle some of those calls.

I build bots for a living, so my first reaction wasn’t excitement about the product. It was a permissions audit running in my head.

About that 0-day claim

The headline going around says Muse has a serious zero-day. I want to be straight with you, because this site is for people who ship things: I can’t verify that. What’s actually documented is the opposite shape of story. Meta has said Muse is being tested with safety protections and hardened against vulnerabilities through a bug-bounty program. There’s no public technical detail about a specific unpatched flaw that I’ve been able to confirm.

So treat the 0-day framing as a claim awaiting evidence. What’s more useful, and more durable, is the question underneath it: why does an agent like Muse make people nervous enough that “serious 0-day” sounds immediately plausible?

Privilege is the story, not the bug

Chatbots answer. Agents act. That distinction sounds small until you write the code.

When I build a retrieval chatbot, the worst case for a prompt injection is usually embarrassing output. Someone gets the bot to say something dumb, I patch the system prompt, I add an output filter, life continues. The blast radius is text.

An agent with phone access has a different failure mode entirely. Consider what has to be true for that tire shop call to work:

• The agent holds identity it can assert on your behalf, by voice, to a human who has no way to verify it
• It has outbound action capability that reaches outside any sandbox you control
• It carries enough context about you to sound credible, which means it carries enough to be useful to someone else
• It makes real-time judgment calls about what to disclose, with no review step before disclosure happens

Each of those is a privilege. Stack them and you get something that looks less like a chat interface and more like a service account with your name on it. Anyone who has accidentally handed an automation broader IAM permissions than it needed knows the feeling.

The concierge wrinkle

The human-contractor detail is the part I keep turning over. From a product standpoint it’s sensible. Phone calls are messy, receptionists go off-script, and a human fallback keeps the experience from collapsing on edge cases. Plenty of us have shipped a human-in-the-loop escape hatch for exactly this reason.

From a trust standpoint it changes the threat model. The data path now includes people, which means your exposure isn’t only about model behavior and API scopes. It’s about access controls on the contractor tooling, what a reviewer can see while assisting a call, and whether the user knows a person may be involved. Those are process questions, not model questions, and process is harder to patch.

Meta is making this bet from an awkward position. TechCrunch noted the launch came less than two weeks after the company agreed to an $18 billion multistate settlement over social media’s consumer harms. Zuckerberg has pitched supercharged assistants as the next big leap and part of the justification for heavy data center spending. The ambition is clear. The trust surplus is thinner.

What I’d take back to my own code

If you’re building agents, Muse is a useful mirror. Three habits I’d push:

• Scope capabilities per task, not per session. An agent that can place calls should hold that permission for the call it was asked to place, then lose it.
• Treat everything the agent hears on a call as untrusted input. A voice on the other end is an injection vector.
• Log disclosures, not just actions. Knowing a call happened is less important than knowing what the agent said about your user.

The interesting thing about Muse isn’t whether a specific flaw exists today. It’s that we’re shipping assistants with enough privilege that the question lands as obviously fair. That’s a design conversation worth having before the incident report, not after.

🕒 Published: October 2, 2026