Meta patches Muse AI zero-day exploit that let attackers hijack the agent
A zero-day in Meta’s Muse macOS app let any local app redirect cloud transcription to an attacker-controlled endpoint, exposing accounts and enabling photo capture or malicious file writes without alerts. Meta issued a hotfix within hours of Ars Technica’s September 2026 report.
Meta has issued a patch for its Muse macOS app after security researcher Patrick Wardle discovered a zero-day vulnerability that could allow attackers to take control of the AI agent. The flaw was publicly detailed by Ars Technica in September 2026, and Meta deployed a hotfix within hours of the report being published.
Wardle found that the exploit leveraged an undocumented Muse setting that allowed any app running local code to redirect the agent’s transcription processing away from Meta’s servers to an attacker-controlled endpoint. That redirection gave the attacker access to the victim’s Muse account. Several design decisions contributed to the vulnerability, including processing Muse dictation in the cloud rather than on-device, and allowing any app to modify all of Muse’s undocumented settings. Wardle’s proof-of-concept attacks demonstrated the ability to take pictures and write malicious files to disk through Muse, often without alerting the user.
“We can manipulate the agent and leverage its privileges to do whatever we want,” Wardle told Ars Technica. “At the very least, they should be thinking about security from the very start, and they are just not.”
Meta characterized the practical risk as limited. “This was a local privilege escalation attack, not a remote exploit,” said David Singleton of Meta Superintelligence Labs. “Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low.”
The incident is notable given that Meta had emphasized Muse’s privacy and security features at the agent’s launch earlier in September 2026. The vulnerability surfaces as Muse faces additional scrutiny: Amazon has blocked the app from accessing its e-commerce platform, claiming Meta never obtained permission to do so. Despite the turbulence, Muse’s mobile app downloads during its first 12 days reportedly outpaced ChatGPT’s debut figures in the US and Canada, with Meta’s stock rising 11 percent on the same day.