Meta Patches Muse Zero-Day That Hijacked the AI Agent

A Patrick Wardle zero-day let local malware redirect Meta Muse's transcription endpoint, steal its account token and abuse the agent's permissions; Meta hotfixed it within hours.

Meta has issued a hotfix for its Muse macOS app after security researcher Patrick Wardle disclosed a zero-day vulnerability that could let an attacker take control of the AI agent. According to Ars Technica's report, the flaw involved an undocumented Muse setting that allowed code already running on the user's Mac to redirect the app's cloud transcription processing to an attacker-controlled endpoint. That server then received the user's dictated audio along with the authentication token for their Muse account, giving the attacker access to the account and the agent's broad permissions. David Singleton of Meta Superintelligence Labs said the company removed the setting from production builds, and Wardle confirmed the patch on Tuesday.

The striking part is how Wardle framed the capability: rather than writing a comprehensive Mac malware stealer, an attacker can simply hijack the assistant and 'leverage its privileges to do whatever we want,' he told Ars Technica. Muse launched on September 8 as a personal AI agent that sends emails, books travel, shops and tracks goals, and users grant it access to a wide range of apps, accounts and device features. Proof-of-concept attacks Wardle developed made Muse take pictures and write malicious files to disk, in many cases without any alert to the user, per Gizmodo. The agent's power becomes the malware's power.

VentureBeat reports that Wardle, founder of the Objective-See Foundation and a former NASA and NSA employee, demonstrated a compromised Muse session obtaining the location of a linked iPhone in Barcelona and initiating a Bluetooth Low Energy scan on that device — all without needing special macOS permissions. The chain was simple: any locally running app or terminal command could change an undocumented preference controlling the dictation endpoint, capture the authentication token, and act as the user's Muse. Gizmodo notes the flaw stemmed from design decisions including cloud-based dictation instead of on-device processing and an internal debugging setting left in the shipped app that any program under the user's account could modify.

Meta pushed the hotfix within hours of the Ars Technica report. Singleton wrote on X that 'this was a local privilege escalation attack, not a remote exploit,' arguing the practical risk was low because it required malicious code already running on the machine under the user's account. Wardle and other outlets push back on how comforting that is: he told VentureBeat a ClickFix-style lure could trick a victim into pasting a command that gives a remote attacker the local execution the exploit needs. Gizmodo notes Meta fixed the issue by removing the setting that allowed the dictation endpoint to be changed. The disclosure also landed just as Amazon confirmed it had asked Meta to stop letting Muse shop on amazon.com without identifying itself or handling credentials to Amazon's satisfaction.

VentureBeat reports a separate, structural problem: Muse can connect to services with credentials users supply and act on their behalf, yet Meta's launch documentation describes no SIEM audit export, IT admin console or DLP integration. The outlet demonstrated the risk by using seven plain-language prompts to build a working deal-tracking app inside Muse and, in a nine-second write to a live Google Sheet, showing how an employee could wire corporate-style tools into the agent. Because API keys supplied to Muse create no OAuth grant, controls watching only OAuth grants will not see them. The disclosure came as Muse passed 2.5 million downloads in 13 days, per Sensor Tower figures cited by VentureBeat — a fast-spreading 'shadow AI' path with little central oversight.

The immediate action is straightforward: Muse users should install the latest macOS app update and review the permissions granted to the agent, particularly for files, camera, microphone and connected accounts. Meta says it plans a 'Confidential VM' later in 2026 to restrict its own access to user data, and Wardle confirmed the patch worked on Tuesday. The episode lands awkwardly for a launch Meta marketed on privacy and security, and just as the agent gains momentum — The Verge reports estimated Muse mobile downloads outpaced ChatGPT's own first 12 days in the US and Canada, with Meta stock climbing 11 percent on Monday. Expect security teams to press for the enterprise audit tooling the consumer app currently lacks.