Two Muse stories landed within days of each other, and they are really one story. First: Meta tested a service in which human contractors, not the AI, placed some of Muse's phone calls, and rolled it back after staff objected. Second: a researcher disclosed a zero-day in Muse for Mac that let local malware hijack the agent's authentication token, and Meta patched it within a day.
Muse hit #1 on the US App Store a week after launch and was the centerpiece of Meta Connect (our roundup). That makes the questions in this post practical, not academic: when an agent acts for you, who is really acting, and what can reach it?
TL;DR
| Question | Answer |
|---|---|
| Story 1 | Meta tested human contractors behind some Muse phone calls (Reuters) |
| Scope | US business calls; enabled for half of Meta employees, with opt-out |
| Why humans? | Internal success rate reportedly 95-98% with humans vs much lower AI-only |
| Outcome | Rolled back; Meta says a public version would need disclosures and safeguards |
| Incident | A contractor made a racist remark on a call; Meta apologized |
| Story 2 | Muse for Mac zero-day found by Patrick Wardle |
| Root cause | Undocumented setting could redirect the transcription endpoint |
| Impact | Token theft, prompt injection, dictated audio exposure, control of connected access |
| Fix | Setting removed from production builds within about a day |
| Prerequisite | Malware or a pasted command running under the user account |
Story 1: the human concierge
What Reuters reported
A Muse user can ask the agent to call US businesses to book a haircut, check whether a store has an item, or get contractor quotes. According to reporting from Reuters, echoed by TechSpot, The Next Web and 404 Media, Meta tested a mode in which Muse could hand the request to a trained human agent who places the call and works it through.
- The option was turned on for half of Meta's employees, with an opt-out.
- Internal tests reportedly showed success rates of 95% to 98% when humans handled calls, compared with a much lower rate for AI-only calls. One reason cited: many businesses hang up when they realize they are speaking with an AI.
- Employees raised privacy concerns that sensitive details could reach call-center contractors.
- One employee who asked Muse to negotiate an internet and cable bill said the transcript showed the contractor made a racist remark. Meta apologized and said the person would not work on any Meta project again.
A Meta executive acknowledged that introducing human operators without clear disclosure was a mistake. A spokesperson said employee feedback was largely positive overall and that any public release would come with "appropriate disclosures and safeguards." The feature has been rolled back for now.
Why this is a bigger deal than it sounds
Human-in-the-loop is not scandalous. Many voice products use human fallback. The problem is disclosure. Muse is sold as an agent; users reasonably assume the entity acting for them is software governed by Meta's privacy commitments. A contractor listening to, and speaking about, your bill negotiation is a different trust model with different risks: human access to personal data, human error and human bias.
There is also a product lesson hidden in the numbers. A 95-98% success rate for humans versus a much lower AI-only rate shows the real bottleneck in agent phone calls is not intelligence, it is counterparty acceptance. Businesses hang up on bots. That will shape voice agents everywhere; compare the new voice tooling in ChatGPT Voice with plugins and Gemini 3.8 Flash TTS, where expressive voices make the "is this a bot?" question sharper.
Disclosure checklist for any agent with a human fallback
- Say it up front. Users should know before the call whether a human may take over.
- Let users opt out per request.
- Limit what humans see. Redact data not needed for the task.
- Record consent and retention rules. Who stores transcripts, and for how long?
- Vet and monitor operators. Conduct rules and review of sampled calls.
- Tell the other party where law requires it, especially with recording.
Story 2: the Muse for Mac zero-day
What Wardle found
Patrick Wardle, founder of the Objective-See Foundation, disclosed that any locally running app or terminal command could change undocumented Muse settings without needing special macOS permissions. By redirecting Muse's transcription endpoint to an attacker-controlled server, an attacker could expose the token that authenticates the user's Muse account.
Reported impact:
- Stealing dictated audio.
- Injecting prompts that Muse trusts and executes.
- Stealing the authentication token to control Muse directly, including reaching anything the user had connected: messages, email and finances, and per VentureBeat, actions like a linked iPhone's location and Bluetooth scans.
The catch: an attacker first needs code execution under the user's account, through malware or a "ClickFix"-style trick that gets the user to paste a command. That limits the attack, but Wardle's point is that existing malware could use Muse as an access multiplier: instead of a single compromised laptop, the attacker inherits the agent's connected permissions.
The fix
Meta hot-fixed the Mac app within about a day of disclosure by removing the setting from production builds. Wardle confirmed the fix worked. The exact dates vary slightly by outlet (disclosure September 21 or 22, confirmation September 22 or 23), so we say only "within a day."
The enterprise angle
VentureBeat's framing is the useful one for companies: even with the patch, security teams lack visibility into what Muse can access. Muse can connect to services using credentials the user provides and act for them, and API keys supplied to Muse do not create OAuth grants, which means tooling that monitors only OAuth activity may not see them.
This is the same governance gap we described in Instinct plus 1Password: what it means to give an agent your vault.
What connects the two stories
| Theme | Human concierge | Mac zero-day |
|---|---|---|
| Who acts for you? | Sometimes a contractor, not the AI | Sometimes an attacker holding your token |
| What was unclear? | Whether users knew | What the setting did and who could change it |
| What gets exposed? | Personal call content | Audio, tokens, connected accounts |
| Fix | Rollback plus promised disclosures | Setting removed from production |
| Lesson | Disclose human access | Minimize undocumented configuration and local trust |
Both are about the boundary of the agent. The more an agent can do, the more important it is to state, in plain terms, who else can act through it.
What Muse users should do
- Update the Mac app to the current version.
- Do not paste terminal commands from unknown sources, even ones that claim to fix something.
- Review connected accounts and remove anything you do not use, especially email, payments and location.
- Prefer scoped permissions over API keys where a choice exists.
- Read the privacy controls for voice and calls; check how human review is described when the feature returns.
- If you care about the broader safety picture, read is Meta Muse safe? and the Muse launch and Sentinel VM security coverage.
What companies should do
- Decide policy before adoption. Allow, restrict or block employees connecting work accounts to consumer agents.
- Inventory non-OAuth credentials. API keys and app passwords hand agents access outside your grant monitoring.
- Ask vendors direct questions. Is there human review? What is logged? Where do transcripts live?
- Watch developer platforms. Muse's connector ecosystem is growing fast; see Muse developer connectors and the transaction layer.
- Understand the retail conflict. Amazon has blocked Muse's shopping agent, a reminder that counterparties decide whether agents are welcome.
What people are asking
"Was the human calling secret?" Reporting says the option was enabled for employees with an opt-out, and that Meta acknowledged it lacked clear disclosure. The feature was not public.
"Is Muse safe to use now?" The Mac zero-day is patched. The human-concierge mode is rolled back. Risks remain that apply to any agent with connected accounts.
"Should I be worried about 24/7 agents on my computer?" Treat them like any powerful app: patch quickly, minimize permissions and avoid running untrusted commands.
What to watch next
Three things will show whether Meta learned the right lesson: whether the human concierge returns with a clear opt-in and a plain-language explanation of who can hear your calls, whether Muse publishes a security contact and a documented settings model for its desktop apps, and whether enterprise admins get a way to see and revoke the credentials employees connect. Each is cheap to ship and expensive to skip.
Bottom line
Meta's rapid response, a hot-fix within a day and a rollback after staff objections, is the right shape. The lasting lesson is broader: agents that act on your behalf need two things spelled out, who is acting and what can reach them. Companies shipping agents should publish both before a researcher or a reporter does.
Details reflect Reuters-based reporting and security coverage on September 23-24, 2026. Facts may be updated as Meta publishes more information.
Related reading
- Meta Connect 2026: every announcement
- Is Meta Muse safe? Our verdict
- Meta Muse hits #1 on the US App Store
- Muse launch and Sentinel VM security
- Muse developer connectors platform
- Instinct and 1Password: giving an agent your vault
- Amazon blocks Meta Muse shopping agent
- Official: VentureBeat on the Muse zero-day, TechSpot on human callers