Meta Patches Muse macOS Zero-Day After Local Agent Takeover Disclosure
Meta has patched a zero-day vulnerability in its Muse app for macOS that could allow takeover of the AI agent. The flaw was found by security researcher Patrick Wardle and became public with an Ars Technica report on Sept. 21, 2026. Meta shipped a hotfix within hours, according to reporting on Sept. 22. The Verge
The issue centered on transcription handling and undocumented preferences. Muse dictation was processed in the cloud instead of on-device. An attacker with code already running locally could use an undocumented Muse setting to redirect that transcription processing from Meta's servers to an attacker-controlled endpoint. Any app could control all of Muse's undocumented settings, which widened the path from a local process to agent behavior.
The precondition matters. Exploitation required local access with malicious code already running on the user's machine under the user's account. It was not a remote network exploit. Wardle also described the Muse agent as hijackable through a simple ClickFix-style attack, a technique that relies on getting a user to run attacker-supplied steps locally. Cybernews
Once that local foothold existed, the impact was broad. Successful exploitation gave the attacker access to the victim's Muse account. In proof-of-concept attacks, Wardle used Muse to take pictures and write malicious files to disk without alerting the user in many cases. That combination, account access plus silent use of agent capabilities and local file writes, is what made the bug a takeover issue rather than a narrow settings-tampering bug.
Meta framed the severity in narrow terms. Superintelligence Labs executive David Singleton described the issue as a “local privilege escalation attack” and said the practical risk to users was “quite low” because remote exploitation was not involved. The company’s fast hotfix suggests the priority was to close the transcription-redirect path and lock down the settings surface before public proof-of-concept code could circulate more widely.
Two separate developments arrived alongside the patch news. Amazon blocked the Muse AI agent from accessing Amazon's e-commerce platform, claiming Meta never obtained permission to do so. Separately, estimated downloads of the Muse mobile app in its first 12 days reportedly outpaced ChatGPT's 12-day debut in the US and Canada.
The broader context here is architectural, not only a single bug. A highly privileged agent that can act on files, camera input, and account-linked services inherits the security properties of its weakest control plane. In this case that included cloud-routed dictation, mutable undocumented settings exposed to other local processes, and account binding that persisted after compromise. For defenders, the lesson is familiar from endpoint security and browser sandbox work. Local code execution is often treated as game over, but agent frameworks raise the cost of that assumption because one local compromise can be converted into persistent account access and unattended actions.
Looking at what this means for agent builders, the fixes point in clear directions. Undocumented control surfaces need the same access controls and audit logging as public APIs. Cloud fallback for sensitive functions such as transcription needs endpoint pinning and integrity checks, not client-selectable routing. And user consent needs to be bound to the actual action being taken, especially when the agent can write files or capture media without a visible prompt. In my view, the speed of this patch is encouraging, and the long-term gain is a more robust pattern for agentic apps on desktop operating systems where many processes already share the same user context.
