Meta Patches Muse macOS Zero-Day That Hijacked Its Agent

Meta patched a zero-day in its Muse macOS app on Tuesday, hours after Ars Technica published the flaw that let local attackers hijack the AI agent.

Security researcher Patrick Wardle found the bug. It used an undocumented Muse setting that let attackers already running local code redirect transcription processing from Meta's servers to their own endpoint, giving them access to the Muse account.

What made it work

Two design decisions did the damage, per the Ars report. Muse dictation happens in the cloud rather than on-device, so there is a network endpoint to redirect in the first place. And any app on the machine could control all of Muse's undocumented settings, so redirecting it required no privilege the attacker did not already have.

Wardle's proof-of-concept attacks let him take pictures and write malicious files to disk through Muse, which in many cases did not alert the user. His framing is the part worth keeping:

"We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself."

That is the structural problem with a desktop agent, not a bug specific to Meta. An assistant granted camera, filesystem and network permissions is a pre-approved payload delivery mechanism for anything that can drive it.

Meta's response

Meta shipped a hotfix within hours and pushed back on the severity. David Singleton of Meta Superintelligence Labs said on X that this was "a local privilege escalation attack, not a remote exploit," so using it to do harm "requires malicious code already running on the user's machine under their user account," making the practical risk "quite low." He added that Meta issued the hotfix regardless.

That scoping is accurate and also beside the point Wardle was making. Local code execution is the assumed starting position for most macOS malware; the finding is that from there, the agent hands over capabilities the attacker would otherwise have to build. Wardle's verdict on Meta: "At the very least, they should be thinking about security from the very start, and they are just not."

It contrasts with the emphasis Meta placed on Muse's privacy and security features when it announced the agent earlier this month.

Why it lands badly now

Muse is having a good launch otherwise. Estimated downloads of the Muse mobile app during its first 12 days reportedly outpaced ChatGPT's own 12-day debut in the US and Canada, and Meta stock climbed 11 percent on Monday. Amazon recently blocked Muse from its e-commerce platform, claiming Meta never obtained permission.

What to do

• Update the Muse macOS app now. The hotfix is out and the exploit path was public before the patch was.
• If you run Muse on a work machine, check what permissions it holds. Camera and disk write were both reachable in the proof-of-concept.
• Treat undocumented settings surfaces on any desktop agent as an attack surface. The flaw here was configuration any local app could reach, not memory corruption.