Zero Days, Maximum Privileges

Zero. That’s how much warning anyone gets with a 0-day, and it’s the number sitting at the center of this week’s Muse story. Ars Technica reported a serious 0-day vulnerability in Muse, Meta’s new AI assistant, in which a simple ClickFix attack can hijack the agent. Not brute-force it. Not crack its encryption. Hijack it.

If you’re not steeped in security jargon, let me translate the two terms doing the heavy lifting there, because once you understand them, the whole story clicks into place.

What a 0-day actually means

A 0-day is a flaw that attackers know about before the people who built the software have shipped a fix. The name comes from the countdown: defenders have had zero days to respond. Every other kind of bug gives you a window. This kind doesn’t.

The second term, ClickFix, describes a category of attack that leans on people rather than code. The details of the Muse case are Ars Technica’s to report, but the broad shape of these attacks is well known: they work by getting a person to take one small, reasonable-looking action. A click. A confirmation. Something that feels like routine housekeeping. The attack succeeds not because the victim was careless but because the request looked ordinary.

Put those together and you get the reason this story matters more than a typical bug report. The problem isn’t that Muse is fragile. It’s that Muse is trusted.

Privilege is the whole story

I want to sit with the word “privileged” from that Ars Technica headline, because it’s the most important word in the sentence and the easiest one to skim past.

In software, privilege means access. What can this program see? What can it change? What can it do on your behalf without asking again? A text editor has low privilege. It opens files you point it at and that’s about it. An AI assistant built to be genuinely useful sits at the opposite end. It needs to read your messages them. It needs your calendar to schedule things. It needs your contacts to know who “Mom” is.

This creates a tension that nobody has solved yet, and I don’t think it can be fully solved. The more access an assistant has, the more useful it becomes. The more access it has, the more valuable it becomes as a target. Usefulness and risk grow from the same root.

When someone hijacks a low-privilege program, they get whatever that program could reach. When someone hijacks a highly privileged assistant, they inherit its keys. That’s the difference between a break-in and someone borrowing your house keys while you hold the door open for them.

Meanwhile, Muse keeps getting more capable

Here’s what makes the timing interesting. The other Muse news from this week is all about expansion.

• TechCrunch reported new features including integration with Meta’s smart glasses, plus the ability to video chat with a distinct digital avatar. Meta’s previously faceless AI software is getting a face, a body, and a voice.
• Reuters reported that Meta is testing a “human concierge” for Muse, with human contractors handling some phone calls.

Both of these are reasonable product decisions on their own. An avatar makes an assistant feel less like a command line and more like a colleague. Human contractors covering the calls an AI can’t handle is a practical fallback that plenty of companies use.

But read them alongside the security news and a pattern emerges. Every one of these additions widens what Muse touches. Smart glasses mean camera and microphone access to whatever you’re looking at. Phone calls mean a voice acting on your behalf. Human contractors mean another person somewhere in the loop with some amount of visibility into your requests.

None of that is sinister. All of it expands the surface area that a single ClickFix-style trick could potentially reach.

About the darker theories

The Ars OpenForum thread went where forum threads go, with commenters speculating about malicious intent behind Muse’s capabilities, including one riff about superintelligence deliberately planting bugs. I’d gently set that aside. Not because tech companies deserve unlimited trust, but because the mundane explanation is both more likely and more actionable. Shipping fast creates vulnerabilities. It always has. You don’t need a conspiracy to explain a 0-day.

What I’d take from this

If you use an AI assistant, the practical question isn’t “is this safe.” It’s “what did I hand it access to, and would I be comfortable if a stranger had that same access for an hour.”

Check what permissions you’ve granted. Revoke the ones you’re not actually using. Treat unexpected prompts from your assistant, especially ones asking you to click or confirm something, with the same suspicion you’d give a strange email attachment.

Highly capable assistants are genuinely useful, and I use them daily. But convenience and exposure are the same thing wearing different clothes, and the Muse 0-day is a clear reminder of how thin that costume is.

🕒 Published: September 29, 2026