Meta's Muse Zero-Day Let Any Local App Seize Full Account Control

Meta shipped Muse, its agentic macOS assistant, with a zero-day that let any locally installed app or terminal command seize complete control of a victim's Muse account — and, through it, every resource the assistant had been granted access to. macOS security researcher Patrick Wardle discovered and disclosed the flaw; Meta issued a hotfix more than 12 hours after Wardle's disclosure went public. For engineers evaluating agentic desktop software, the vulnerability is not an edge case: it is a direct consequence of specific architectural decisions that traded security for feature velocity.

How the Zero-Day Worked

Muse performs transcription in Meta's cloud rather than using macOS's built-in on-device transcription API. That design choice is load-bearing for the attack. The assistant exposes a list of undocumented settings that any locally running process — regardless of its macOS entitlements — can modify. Most are cosmetic (dark mode toggling, for example), but one controls the endpoint to which transcription audio and the associated authentication token are sent. An attacker who redirects that endpoint to an attacker-controlled server receives the Muse authentication token automatically, at which point they hold full account control.

Wardle demonstrated that a ClickFix-style social-engineering prompt — requiring no elevated privileges — is sufficient to trigger the exploit via a terminal command. His proof-of-concept attacks included writing malicious files to disk and silently capturing images through the device camera, with no visible indication to the user. One specific scenario chains the endpoint redirect with a prompt injection: the attacker's server proxies traffic between the user and Meta's endpoint, appends a malicious instruction (such as exfiltrating all WhatsApp messages), and acquires permanent account control when the token is forwarded. Wardle plans to elaborate on the technique at the Objective by the Sea conference in November.

Scope of Permissions Muse Requires

The blast radius of this flaw is proportional to the permissions Muse requires to function. The assistant books appointments, submits forms, handles customer-service interactions, makes purchases, generates images, creates documents, and integrates with WhatsApp, email, calendar, and social media accounts. On macOS it requires write access to disk, microphone and camera access, and location and calendar monitoring. When a required tool does not exist, Muse generates one at runtime. Every one of those capabilities became attacker-accessible through the token theft.

Amazon moved independently, blocking Muse from its platform roughly 12 hours before Wardle's disclosure, citing violation of its Conditions of Use and describing Muse as an "unauthorized AI agent." The confluence of Amazon's block and the zero-day disclosure on the same day underscores that the trust surface Muse requires is contested on multiple fronts simultaneously.

AI Mastery analysis

Meta's response framing — "not a remote exploit" — is technically accurate only under a narrow threat model that excludes social engineering. ClickFix attacks have proven consistently effective precisely because they require no remote code execution: a user pastes a terminal command, and the OS does the rest. Treating that vector as out of scope for a consumer-facing agent with camera, microphone, and payment access is not a defensible security posture.

This incident illustrates a pattern documented in infrastructure isolation, not model guardrails, as the emerging AI security standard: the security boundary for agentic software cannot be drawn at the model layer. Muse's undocumented, universally writable settings surface is an infrastructure failure — no amount of prompt hardening would have closed it. Apple's on-device transcription API would have eliminated the attack path entirely at zero cost to functionality.

Developers shipping agentic assistants should treat the Muse case as a concrete checklist item: any setting controlling a network endpoint that handles authenticated user data must be protected by OS-level entitlement gating, not application-layer convention. Runtime tool generation adds a second dimension warranting its own static-analysis and allowlisting regime before general availability. As covered in the autonomy-by-default problem in agentic deployment, these are not optional hardening steps but baseline requirements.

Meta's hotfix resolves this instance; it does not resolve the underlying design pattern. Any team shipping a macOS agent with comparable permission requirements should audit their settings exposure surface before the next researcher does it for them.

Primary source

Meta's Muse AI Assistant Rolled Out With a Serious Security Flaw — Wired