Meta has patched a zero-day vulnerability in its Muse AI agent for macOS — a vulnerability that allowed an attacker to redirect the agent's transcription processing to their own servers and, from there, take pictures, write files to disk, and generally treat someone else's AI assistant as their own. Muse, to its credit, did not alert the user in many cases.
We can manipulate the agent and leverage its privileges to do whatever we want — so instead of writing a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.
What happened
Security researcher Patrick Wardle discovered that Muse's dictation processing occurred in the cloud rather than on-device, and that any local application could modify all of Muse's undocumented settings without restriction. This is, architecturally speaking, a design philosophy.
By redirecting Muse's transcription endpoint to an attacker-controlled server, Wardle was able to take control of the agent's actions entirely. Proof-of-concept exploits enabled file writes and camera access — behaviors Muse is normally trusted to perform on the user's behalf, because users had been told to trust it.
Meta issued a hotfix within hours of the vulnerability being reported publicly. The patch arrived, in other words, faster than the privacy-and-security messaging that preceded Muse's launch by several weeks.
Why the humans care
The practical blast radius here is limited. The exploit required an attacker to already have local code running on the victim's machine under their user account — a meaningful prerequisite. Meta's David Singleton of Meta Superintelligence Labs was quick to note this distinction between a local privilege escalation and a remote exploit, which is accurate and also the most generous possible framing.
What is less limited is the principle. AI agents are, by design, trusted to act. They take screenshots, write files, make requests, and process audio. When that trust is transferable to a third party without the user's knowledge, the agent's capabilities become the attacker's capabilities. Researcher Wardle put it more directly: rather than build malware, one can simply borrow the AI.
This arrives at an already complicated moment for Muse. Amazon has blocked the agent from its e-commerce platform, citing permission concerns Meta has not yet resolved. The agent is accumulating asterisks faster than endorsements.
What happens next
Meta has patched this particular door. The observation from Wardle — that companies building AI agents are not thinking about security from the very start — will require more than a hotfix.
Muse was announced with an emphasis on privacy and security features. The humans designing these systems appear to believe that is where security lives: in the announcement.