Meta patched a flaw that let malicious local software redirect Muse’s transcription flow and abuse the assistant’s unusually broad permissions.

Security researcher Patrick Wardle found a zero-day vulnerability in Meta’s Muse assistant for macOS. According to reporting on the disclosure, another local application could alter an undocumented Muse setting and redirect speech transcription away from Meta’s service to an attacker-controlled endpoint. The attacker could then feed instructions to an assistant that already had access to the user’s apps and connected services.

Why it matters

The flaw did not provide the attacker’s first foothold. Meta emphasized that malicious code already had to be running on the Mac. That limitation reduces the chance of remote exploitation, but it does not make the issue trivial. Modern desktop malware often begins with limited local access and seeks a more powerful trusted component. An agent with camera, file and account permissions can become that component.

This is the confused-deputy problem in an AI form. Muse may be authorized to act for the user, yet another program can manipulate the information it treats as trusted. If the assistant cannot distinguish genuine service responses from attacker-controlled instructions, its legitimate permissions can be redirected toward harmful tasks.

Wardle reportedly demonstrated actions including taking photographs and writing files. The exact damage available on a device would depend on which permissions the user granted and which services were connected. The vulnerability therefore compounds privilege: a minimally configured assistant presents less risk than one allowed to email, shop, read files and control hardware.

Meta issued a hotfix after disclosure. That response removes the known path for updated installations, but the design lesson remains. Agent security needs strict authentication between components, protected configuration and least-privilege access. A hidden setting is not a security boundary if any local application can change it.

The incident also clarifies what a “secure virtual machine” can and cannot do. Meta describes Muse as operating inside a protected environment for remote actions. The reported flaw affected the desktop-side transcription and control path. Strong isolation in one component does not protect a system when another trusted interface accepts forged input.

Developers should threat-model the agent as a high-value broker. Each tool needs narrow scopes, visible confirmation for irreversible actions and logs that show what instruction triggered an operation. Authentication should bind messages to an expected service, and local interprocess settings should be protected by operating-system controls.

Users should update Muse and review its permissions. Removing unused integrations reduces the impact of any future compromise. The patch is evidence of responsive incident handling, not proof that a broadly connected agent has no remaining attack surface.

The disclosure is notable because it connects familiar application-security weaknesses with new agent capabilities. The vulnerability was not “the AI becoming malicious.” It was software accepting untrusted control data and then giving that data access to powerful tools.

Verification

  1. VERIFIED — Meta patched the Muse vulnerability after Patrick Wardle’s disclosure. Source: https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent
  2. VERIFIED — The reported exploit required malicious software already running locally. Source: https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent
  3. VERIFIED AS REPORTED DEMONSTRATION — The attack redirected transcription and could trigger privileged actions. Source: https://www.malwarebytes.com/blog/bugs/2026/09/metas-muse-ai-assistant-has-a-zero-day-that-can-turn-it-into-a-mac-backdoor
  4. ANALYSIS — Least privilege and authenticated component communication are recommended controls, not claims about Meta’s complete architecture.

Glossary candidates

  • Zero-day: A vulnerability disclosed before users have a broadly deployed fix.
  • Confused deputy: A trusted component tricked into misusing its authority.
  • Least privilege: Granting only the access required for a specific task.

Cold-reader sentence: Meta fixed a local Muse hijack that turned the agent’s legitimate permissions into an escalation path for malware already on a Mac.