Meta patches Muse macOS zero-day that let local attackers hijack the AI agent

Meta rushes out a Muse hotfix

Meta has patched a zero-day vulnerability in the macOS version of Muse, its recently launched AI agent, after a security researcher demonstrated that the flaw could be used to take control of the assistant and abuse the permissions it holds on a user's machine.

According to The Verge, the bug was found by Patrick Wardle, a researcher with a long track record in macOS security. Citing Ars Technica's reporting, The Verge says Wardle identified an undocumented setting inside Muse that allowed code already running on a device to redirect the app's transcription processing away from Meta's servers to an endpoint controlled by the attacker, which in turn opened the door to the victim's Muse account.

How the attack worked

Two design decisions reportedly combined to create the weakness. Muse carries out dictation in the cloud rather than on the device, and any application on the Mac was able to modify all of Muse's undocumented settings, not just Muse itself. Together, those choices meant local malware could silently reconfigure where the agent sent its data.

Wardle built proof-of-concept attacks to test the exploit. Through the hijacked agent he was able to take pictures and write malicious files to disk, and in many cases Muse raised no alert to the user. As he told Ars Technica, an attacker can "just leverage the AI assistant itself" rather than writing comprehensive Mac stealer malware, and he argued that Meta should be building security in from the start instead of treating it as an afterthought.

The discovery sits awkwardly beside the privacy and security emphasis Meta placed on Muse when it unveiled the agent earlier in the month.

Meta calls the practical risk low

Meta shipped a patch within hours of Ars Technica's report going live. David Singleton of Meta Superintelligence Labs said in a post on X that the issue was a local privilege escalation rather than a remote exploit: exploiting it required malicious code already running under the user's account, which he said made the practical risk to users of the Muse Mac app quite low. He confirmed that a hotfix had nonetheless been issued to address the problem.

A high-profile launch under scrutiny

The vulnerability landed while Muse is already under a spotlight as Meta tries to claw back ground from rival AI providers. Amazon recently blocked the agent from its e-commerce platform and says Meta never obtained permission for that access in the first place.

On the other side of the ledger, The Verge reports that estimated downloads of the Muse mobile app in its first 12 days outpaced ChatGPT's own 12-day debut in the US and Canada, and that Meta's stock climbed 11 percent on Monday.

Why it matters

This is one of the clearest early illustrations of the security trade-offs that come with agentic AI. An assistant that can operate a camera, write files and act on a signed-in account is, by definition, a bundle of capabilities, and Wardle's work shows how valuable that bundle becomes to malware that already has a foothold on a machine. Meta is right that local access is a meaningful prerequisite, but malware already running under a user's account is the normal operating condition for infostealers, and a privileged agent hands those attackers capabilities they would otherwise have to build themselves. For every vendor racing to ship agents, the takeaway is that undocumented settings, cloud-bound data flows and inter-process controls are part of the attack surface, and they need to be treated that way from the first design review rather than patched after a researcher demonstrates the alternative.