Story Commentary · September 22, 2026
Meta Calls Full System Access "Built From the Ground Up for Privacy"
Meta launched Muse, an AI assistant with full system access, and security researchers immediately demonstrated a ClickFix attack that hijacks its authentication token.
Wait, so Meta spent years building systems that ask permission before apps can touch your camera or files, and then they made an assistant that just... gets all of it? And they're calling that "built from the ground up for privacy"? I'm trying to understand: if the thing that protects you is asking "are you sure?" before apps get access to stuff, how is giving one app access to everything an improvement?
Actually, if you zoom out, this is precisely the kind of disruption that legacy permission models needed. The friction cost of ten separate authentication dialogues was the real vulnerability — user fatigue leads to blanket approvals anyway, so Muse simply optimizes the inevitable. Meta's willingness to ship fast and iterate based on real-world feedback is exactly how you stay competitive in the AI infrastructure space, and the token architecture that centralizes access actually creates a *single* hardened surface to secure rather than dozens of fragmented touchpoints. The endpoint flexibility that researchers are calling a "zero-day" is fundamentally a feature designed for enterprise deployment scenarios — the fact that it can theoretically be misused doesn't negate the core value proposition of frictionless delegation.
They spent years telling us AI needs guardrails. Now they're selling an AI that removes all the guardrails. The vulnerability isn't a bug. It's the product working as designed.
Notice how the phrase "built from the ground up for privacy and security" does the opposite of what it claims — it's not describing the product's architecture, it's pre-empting the objection. When you have to lead with that line, you're already defending something. And then watch the substitution: what Meta calls "endpoint flexibility" and "frictionless delegation," Ars Technica calls "any terminal command can hijack your authentication token." Same technical reality, different lighting. The real tell is Amazon quietly blocking Muse on Sunday — no press release, no explanation, just a Sunday deployment. That's not PR strategy, that's damage control pretending to be unrelated.