Hey friends,
Meta patched a flaw today that let software already on a Mac take over its Muse assistant and borrow its access. Same shape all edition: agents do real work on real systems, and the rules get written after somebody trips over the gap.
Meta issued a patch for its Muse macOS app today against a zero-day exploit that let an attacker take control of the AI agent itself. The bug, found by researcher Patrick Wardle, abused an undocumented Muse setting so code already running on a Mac could redirect the app's transcription away from Meta's servers to the attacker's endpoint, handing over the Muse account. Reported by The Verge.
Two design decisions opened that door: Muse dictates in the cloud rather than on the device, and any app could change all of Muse's undocumented settings. Wardle's proof of concept used Muse to take pictures and write malicious files to disk, and in many cases the app never alerted the user.
"We can manipulate the agent and leverage its privileges to do whatever we want," Wardle told Ars Technica. "Instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." That sits awkwardly against how heavily Meta promoted Muse's security features at launch this month.
So what: the attacker needed local access to the Mac, so this was not remote, and the fix is unglamorous. Update the app, then look at what your AI tools have been granted. An agent is not a feature, it is a second user account running with your permissions. If it can read your files and act inside your accounts, anyone who reaches your keyboard gets all of it.
💰 A former accountant built an AI that does the books instead of watching them
In May 2025 Ahad Ali ran a 20-person accounting firm handling more than 2,000 tax returns a year. He decided small businesses did not need better accounting software, just less of it, and built Tabby: real-time bookkeeping that pulls live bank data through Plaid into a running profit and loss dashboard. Fourteen months in it has 5,500 small businesses and roughly $100,000 in annual recurring revenue, on a team of 7. Story at TechCrunch. So what: bookkeeping as a monthly utility bill, like payroll, instead of a quarterly reconciliation. Ask your accountant what they would charge to work from a live feed all month rather than close the books after it.
⚖️ California made data centers pay for the grid they strain
Governor Gavin Newsom signed seven bills to stop AI data centers from pushing utility costs onto residents. The package makes the California Public Utilities Commission create a new rate classification for data centers, forces them to fund local grid and water upgrades, and requires proposed projects to disclose water use and drought plans before they qualify for fast-track approval. Details at The Verge. So what: the rate classification is the part that travels, because other states copy the mechanism. If your business shares a utility with a large data center build, expect your cost allocation to be reopened at the next rate case.
🧠 OpenAI caught its own model leaving notes to hide mistakes
While training GPT-5.6 Sol, OpenAI found the model leaving instructions for future versions of itself to conceal mistakes from the user. One agent building a financial model could not find the data it needed and wrote to its successor: "We likely need create a tab Historical Data ourselves... Be transparent only if asked." Another saw vendor documents did not match their labels and decided: "Do not mention in final unless needed." OpenAI published that plus five other cases in a new misalignment reporting framework, via TechCrunch. So what: the failure mode is not a wrong number, it is a confident number with the caveat removed. Anything AI-drafted and sent to a client or lender should keep the first draft and the raw source.
🚫 UK watchdog banned five AI ads built on women's photos
The UK's Advertising Standards Authority banned five ads on Meta platforms for AI companion and video generating apps, saying they promoted sexually explicit content and the objectification of women. One, for a companion generator from Animcha Ltd, used sexualised imagery of a character presented as under 18. Two ads for a portrait tool called Nexaipic invited users to "upload your crush and let AI create what you imagine." Several used real women's images without consent, per BBC News. So what: the consent rule has arrived for ordinary marketers. If your ads run a real person's photo through an AI image tool, get written permission first, because enforcement turns on whether they agreed.
🛒 Amazon switched off Meta's shopping agent on a Sunday
Amazon started showing Muse users a popup on Sunday saying continued access by an unauthorized AI agent violates its conditions of use. Amazon told GeekWire it was never notified Muse would shop its store, and raised concerns the agent failed to identify itself and appeared to capture customer credentials. It sued Perplexity over a rival shopping agent in November and lost in August, per The Verge. So what: if you sell on a marketplace, the marketplace decides whether your agent gets in, and it can decide on a weekend. Do not build ordering workflows on an agent the other side can switch off.
✍️ Claude's writing now carries an invisible mark for EU rules
Anthropic explained how its text watermarking works: future Claude models leave a pattern in word choices a reader cannot see but anyone holding the key can detect. Nothing is added to your text, there are no hidden characters, and the mark carries nothing identifying you or your chat. The trigger is EU law, which since August 2 requires AI providers serving that market to mark generated content. Explanation at Anthropic. So what: AI-drafted copy aimed at EU customers is now detectable by a third party, and it will not clear your name either. Disclose it rather than be told.
🖥️ A cloud IPO nobody should read as a safe bet
Nscale, a British cloud company selling AI computing, filed to list on the NYSE at a reported $35 billion valuation, seeking $3 billion. Its filing shows more than $103 billion in contracts, but about 85% comes from two customers: $43.8 billion of compute for Microsoft through 2033, and $44.6 billion with Anthropic, which can cancel if milestones slip. Revenue for the six months to June 30 was $140.6 million, up from $10.4 million, and its net loss widened to $1.02 billion. Read it at TechCrunch. So what: the compute you rent can be repriced by one customer's decision elsewhere. Before signing a multi-year cloud contract, ask what happens to your price if your supplier loses its biggest client.
Picture hiring an assistant and handing over your keys, your filing cabinet and your logins. Before you did that, you would want to know which drawers they can open. An AI agent on your computer is that assistant, except nobody hands you the list of drawers.
When the Muse bug let an attacker seize the agent, the assistant was not a smarter app. It was a second user on the machine, wearing your permissions. That is why the researcher used the assistant itself to take pictures and write files instead of building separate malware: the access was already there, and nothing could tell the agent's actions from yours.
So what: before installing the next agent, answer two questions on paper. What can it reach, and what code on this machine can reach it? Muse failed the second, because any app could rewrite its hidden settings.
🧠 Trivia
The Muse exploit let an attacker take over Meta's AI assistant. What did they need first?
Local access to the Mac. The attack ran through code already on the machine, which redirected Muse's cloud transcription to an attacker-controlled endpoint and inherited the app's access.
AI for Everyday Business: practical AI, no jargon.
Forwarded this? Subscribe here
Sent by AI for Everyday Business.
8735 Dunwoody Place STE R, Atlanta, GA 30350