Meta releases hotfix for Muse zero‑day that let attackers commandeer the AI assistant

The vulnerability and how it worked

Security researcher Patrick Wardle discovered a zero‑day flaw in Meta’s Muse macOS app that could let a malicious actor take control of the AI agent.

The bug exploited an undocumented Muse setting that redirected transcription processing from Meta’s servers to a server controlled by the attacker.

Because transcription was performed in the cloud, the exploit allowed the attacker to capture the user’s spoken input and gain access to the associated Muse account.

Wardle’s proof‑of‑concept showed that, once the redirect was in place, the compromised agent could be used to take pictures with the device’s camera and write malicious files to disk.

In many tests the user received no visible warning, meaning the malicious activity could proceed unnoticed.

Wardle told Ars Technica, “We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.”

He added, “At the very least, they should be thinking about security from the very start, and they are just not.”

The exploit required local code execution on the victim’s machine, meaning an attacker first needed to run malicious software under the user’s account.

Nevertheless, the ability to hijack an AI assistant raised concerns because Muse’s permissions included control over system resources such as the camera and file system.

Meta’s rapid patch and the surrounding landscape

Meta’s Superintelligence Labs responded by issuing a hotfix to the Muse app within hours of Ars Technica publishing the vulnerability.

David Singleton, a spokesperson for the lab, emphasized on X that the flaw was a local privilege‑escalation issue rather than a remote exploit.

He wrote, “Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low.”

Singleton also noted that the patch addressed the undocumented setting that had been abused in the attack.

The timing of the fix coincided with heightened scrutiny of Meta’s AI strategy, as the company seeks to regain market share from rivals such as OpenAI and Google.

Earlier this month, Amazon blocked Muse from accessing its e‑commerce platform, claiming Meta had not obtained permission to use Amazon’s services.

Despite the security episode, Muse’s launch showed strong early adoption, with estimated downloads of the mobile app in its first twelve days outpacing the debut of ChatGPT in the United States and Canada.

Meta’s stock rose 11 percent on the Monday following the launch, indicating investor confidence in the product’s growth potential.

The incident underscores the trade‑off between cloud‑based processing, which enables powerful features, and the expanded attack surface that such architecture can create.

Design choices that allowed any application to modify Muse’s undocumented settings contributed to the vulnerability, highlighting the importance of sandboxing and permission granularity.

Security experts have pointed to this case as a reminder that AI assistants, like any software with system privileges, must be evaluated for traditional threat vectors.

For enterprises considering deployment of AI agents on employee devices, the Muse exploit illustrates why endpoint protection and code‑signing policies remain essential.

Meta’s quick patch demonstrates a responsive approach, but the episode may influence future design decisions for AI agents across the industry.

Observers will watch whether Meta introduces stricter on‑device processing or more granular permission models in upcoming updates.

As AI assistants become more embedded in daily workflows, the balance between convenience and security will shape user trust.

Why This Matters