Meta has patched a zero-day in its Muse macOS app after a researcher showed that local code could hijack the AI agent and access the user’s Muse account. The Meta Muse zero-day required code already running on the Mac, but it exposed the risk of giving one assistant access to a user’s files, apps and connected services.
How the Meta Muse zero-day worked
Security researcher Patrick Wardle found that any locally running app or terminal command could change undocumented Muse settings without needing special macOS permissions, according to Ars Technica’s report. One setting controlled the endpoint used for cloud transcription. Redirecting it to an attacker-controlled server exposed the token that authenticates the user’s Muse account.
Wardle used proof-of-concept attacks to make Muse take pictures and write malicious files to disk without always alerting the user. “We can manipulate the agent and leverage its privileges to do whatever we want,” he told Ars.
The flaw did not provide remote code execution against a clean Mac. An attacker first needed code execution under the user’s account, potentially through malware or a ClickFix-style trick. The local requirement limits the attack, but it also means existing malware could use Muse as an access multiplier rather than having to implement every capability itself.
Meta says the Muse patch closes a local attack
Meta issued a hotfix within hours of Ars’ report, The Verge reported. David Singleton of Meta Superintelligence Labs described the issue as a local privilege escalation attack and said the practical risk was low because malicious code already had to be running on the device.
That assessment is narrower than the capability Wardle demonstrated. Muse was designed to work with files, browser tabs, email, calendars and other connected services, while Meta has promoted it as a privacy- and security-focused agent. The security of the assistant therefore depends partly on the security of the Mac and every permission granted to it.
Meta’s broader Muse rollout has already attracted scrutiny. Amazon began blocking Muse from its site around the same time as the disclosure, while tbreak has previously covered Muse Glimmer and Meta’s open AI models and Muse Image’s Instagram tagging feature.
The Muse patch removes the reported route to account takeover, but users should still install the latest app update and review the permissions given to the agent. Meta has not announced a separate UAE-specific response; the same update advice applies to UAE users testing Muse on macOS.
Should Muse users install the update?
Yes. Muse users should install the latest macOS app update and review the permissions granted to the agent, particularly for files, the camera, the microphone and connected accounts.
Could the Muse zero-day attack a Mac remotely?
Not by itself. The reported exploit required malicious code to be running locally under the user’s account, although malware or a social-engineering trick could provide that starting point.
What is the wider risk with AI agents such as Muse?
An agent with access to many apps and services can amplify the capabilities of existing malware. Limiting permissions reduces the damage if the agent or the device is compromised.
