Two weeks after launching Muse, its personal AI agent, Meta has pushed an emergency hotfix for the Mac app. Well-known macOS security researcher Patrick Wardle publicly disclosed a zero-day on September 21, 2026, showing that local code could quietly take over the agent, and everything it has access to.
Also Read: Chrome 153 Fixes 7th Zero-Day of 2026: Update Now
TL;DR
What: a zero-day in the Muse macOS app let local code redirect dictation traffic and steal the agent's access token
Impact: attackers could make Muse act on their behalf — Wardle's demos wrote files and took photos with the camera
Catch: it needs malicious code already running on your Mac (not a remote exploit)
Fix: Meta removed the vulnerable setting in a hotfix within hours
Action: update Muse now and review its permissions
What is Muse?
Meta launched Muse on September 8, 2026 as a personal agent that can handle multi-step tasks — shopping, payments, email, calendars, travel booking and more. To do that, users connect it to a wide range of apps, accounts and device features. CNBC reported about 2.5 million downloads in its first thirteen days.
Also Read: Programming Guide
Meta has marketed Muse as security-first, with the agent running in an isolated runtime and a separate component called Sentinel controlling permissions and network access, so the agent never sees real credentials.
Also Read: News and IBM
How the attack worked
The flaw sat in Muse's dictation feature, which sends audio to Meta's servers for transcription rather than processing it on the Mac.
The shipped app included an undocumented internal setting that controlled which server dictation requests went to.
That setting lived in the app's local preferences — which, on macOS, any program running under your user account can change without special permissions.
By pointing it at an attacker's server, malicious code could intercept dictation requests and capture the access tokens Muse uses to drive the agent.
With those tokens, an attacker could make the agent do their bidding.
Wardle's point was sharp: instead of writing sophisticated Mac malware, an attacker can simply use the AI assistant's own privileges. His proof-of-concept, published on GitHub, showed Muse writing malicious files and taking pictures, sometimes without an obvious warning to the user.
Also Read: News: Meta Launches Muse,
Meta's response
David Singleton of Meta Superintelligence Labs responded shortly after midnight on Tuesday. He described the issue as a local privilege escalation, not a remote exploit, and said the practical risk was low because malicious code has to be on the machine already. Meta's hotfix removes the endpoint setting from production builds entirely. Singleton also pointed to Meta's bug bounty, which pays up to $300,000 for this class of finding.
Wardle pushed back on the "low risk" framing. Getting code to run locally isn't that hard: ClickFix-style attacks, which trick users into pasting commands into Terminal, are common. Once that foothold exists, the agent becomes a force multiplier.
Also Read: Shopify Ditches React Native for Swift and Kotlin - Programming
Muse's rough week
The security flaw wasn't Muse's only headline:
Amazon blocked Muse from shopping on Amazon.com, citing data security concerns — part of a wider fight over who controls agentic commerce. Shopify, meanwhile, opened its checkout to agents.
Futurism and others criticised how much personal information Muse asks for.
The bigger lesson: agents concentrate risk
The Muse bug fits a growing pattern. The more authority an AI agent has — files, browser, email, payments — the more damage a single weakness can cause. Sandboxing the agent helps, but if an attacker can steal the agent's own identity, the sandbox's permissions become the attacker's permissions.
Also Read: Carbon Immutable vs Mutable in Laravel: Which Should You Use?
This follows similar recent stories, from agent breakouts at major labs to a flaw in Nvidia's NemoClaw that let a malicious website take over an agent.
How to protect yourself
Update Muse to the latest version immediately.
Audit connected services. Disconnect anything Muse doesn't need.
Never paste commands from websites, pop-ups or "fix it" prompts into Terminal.
Limit camera, microphone and file access in macOS Privacy & Security settings.
For developers building agents: don't ship debug endpoints or overridable config in production builds, and treat local preferences as untrusted input.
FAQ
Is Meta Muse safe to use now? The specific flaw is patched. As with any agent, limit what it can access.
Could hackers attack Muse remotely? Not with this bug alone — it required code already running on the Mac. But social-engineering tricks can supply that foothold.
Who found the Muse vulnerability? macOS security researcher Patrick Wardle.
Sources: Gizmodo, Unite.AI, Cybernews, tbreak, iPhone in Canada, GeekWire, CNBC, David Singleton on X.
