Meta founder and CEO Mark Zuckerberg has hyped the security of its new AI assistant Muse, claiming it is “built from the ground up for privacy and security.” A zero-day vulnerability that gives locally run apps and terminal commands complete control of the agent raises serious doubts. Further raising questions, Amazon on Sunday began blocking Muse from its site.

Meta introduced Muse a few weeks ago. The assistant “books appointments, fills out forms and handles customer service,” “proactively takes tasks off your plate,” and can “make purchases, generate images, create documents, and connect with your favorite apps and services.” The mac OS app (curiously, there’s no Windows version) also works with a user’s Whats App, email, calendar, and social media accounts. When a task requires a tool that doesn’t exist, Muse creates one on the fly.

The zero-day allows any app or terminal command to gain access to the token that authenticates users to their Muse account. Meta developers designed the assistant so that any locally installed app or executed code, regardless of the mac OS permissions it has, can change a long list of undocumented settings. One setting allows processes to change the endpoint where transcription occurs. Attackers can exploit this flaw by changing the location to their own endpoint. Once that happens, the attackers have the token that gives complete control over the Muse account.

“We can manipulate the agent and leverage its privileges to do whatever we want,” Patrick Wardle, the mac OS security expert who discovered the zero-day, told Ars. “So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.” Wardle said he has developed several proof-of-concept attacks that do things like writing malicious files to disk and snapping pictures, in many cases with no indication to even an alert user. Meta representatives didn’t answer emailed questions.