Meta Fixed a Mac Bug That Could Let Someone Else Control Its AI

Meta has fixed a security flaw in its Muse app for Macs that could let an attacker take over the AI helper. Security researcher Patrick Wardle found the flaw, which became public in an Ars Technica report on Sept. 21, 2026. Meta released an emergency fix within hours, according to reporting on Sept. 22. The Verge

The flaw involved voice dictation and hidden controls. Muse sent dictated speech over the internet to Meta's computers for processing, instead of handling it on the Mac itself. An attacker who already had harmful software running on that Mac could flip a hidden Muse switch to send that work to the attacker's own computer instead. Any program on the Mac could change those hidden switches. Think of it like secretly forwarding someone's phone calls to a scammer's number.

An important detail is how the attack started. It required harmful software already running on the Mac under the same user account. It was not an attack launched remotely over the network. Wardle also said Muse could be hijacked with a simple ClickFix-style trick, where a person is fooled into following steps that run the attacker's software on their own machine. Cybernews

Once an attacker had that local foothold, the damage could be wide. Successful attacks gave access to the victim's Muse account. In test attacks, Wardle used Muse to take pictures and save harmful files to the computer, in many cases without warning the user.

Meta described the risk in narrow terms. Superintelligence Labs executive David Singleton called it a "local privilege escalation attack" and said the practical risk to users was "quite low" because it did not involve remote attack. The emergency fix closed the dictation redirect path and locked down the hidden settings.

Two separate items arrived alongside the patch news. Amazon blocked the Muse AI agent from Amazon's shopping site, saying Meta never obtained permission for that access. Separately, estimated downloads of the Muse mobile app in its first 12 days reportedly beat ChatGPT's 12-day debut in the US and Canada.

The broader context here is about design, not only one bug. Muse can act on files, camera pictures, and account services. That means it is only as safe as its weakest part. Here that included internet-based dictation, hidden settings that other programs could change, and account access that stayed open after the attack.

Looking at what this means for people who build AI helpers, the fixes point in clear directions. Hidden controls need the same locks and records as public controls. Internet processing for sensitive work like dictation needs checks that stop rerouting. And permission from the user needs to match the real action, especially when the helper can save files or take pictures without a clear warning. In my view, the fast fix is encouraging, and the long-term gain is safer AI helpers on computers where many programs share the same user.