The Pulse
Meta’s Muse Zero-Day Lets Local Apps Hijack the AI Assistant
A macOS zero-day lets locally running apps and terminal commands redirect Muse’s transcription endpoint, exposing the token that controls the AI assistant and its extensive permissions.
AI.info Team ·
A local process can take control of Meta’s agent
On September 21, 2026, macOS security researcher Patrick Wardle disclosed a zero-day in Meta’s Muse assistant that can give locally running apps and terminal commands control over the agent. Meta introduced Muse a few weeks earlier as an assistant that can handle appointments, forms, customer service, purchases and other tasks on a user’s behalf.
Wardle’s findings, reported by Ars Technica, show that an unprivileged local process can change undocumented Muse settings. One setting controls the endpoint used for speech transcription. Redirecting that endpoint to an attacker-controlled server can expose dictated audio and prompts while also sending the authentication token that controls the user’s Muse account.
The vulnerability does not let a remote attacker break into a Mac by itself. An attacker must first get code running locally, such as through malware or a social-engineering technique. Wardle’s concern is that Muse then turns a limited foothold into access to the permissions the user granted the assistant.
Muse’s permissions amplify the damage
Muse works across services and operating-system resources. The assistant can connect to WhatsApp, email, calendars and social-media accounts, while the macOS application may also receive permission to write files, use the microphone and camera, monitor location and access calendars.
That access is central to the exploit’s impact. Once an attacker redirects transcription traffic, the stolen token can be used to manipulate Muse and instruct it to perform actions through the accounts and device resources available to the assistant. Wardle demonstrated proof-of-concept attacks that wrote malicious files to disk and took pictures, in some cases without an alert appearing to the user.
“We can manipulate the agent and leverage its privileges to do whatever we want,” — Patrick Wardle, macOS security expert
Wardle told Ars that an attacker does not need to build a comprehensive Mac malware stealer when Muse already has access to sensitive resources.
Meta’s security design meets a macOS boundary problem
Meta has described Muse as an assistant with extensive access to user data and device resources. Wardle’s finding concerns the local macOS client, where the assistant’s broad operating-system permissions create a separate attack surface. A local application does not need special macOS privileges to alter the undocumented settings that control Muse’s transcription path.
Wardle also criticized Meta’s choice to process dictation in the cloud rather than relying on Apple’s on-device dictation services. A local transcription design would not expose a network endpoint that another process could redirect, according to his analysis.
A ClickFix can turn a foothold into account control
One attack path described by Ars Technica uses a variation of ClickFix, a social-engineering technique that persuades users to run commands or install software. After malicious code starts on the Mac, it can point Muse’s transcription service at an attacker’s server.
The attacker can then intercept a voice prompt, add instructions to it and forward the altered request to Meta. Ars Technica described a possible command that would tell Muse to send an archive of the user’s WhatsApp messages. Because the Muse token is also sent to the malicious endpoint, the attacker can retain control of the account after the initial request.
That sequence matters because it bypasses the normal distinction between a compromised computer and an authorized assistant. Muse already has the permissions needed to act, so the attacker can direct a trusted application instead of asking macOS for each new capability.
Amazon blocks Muse as the flaw emerges
The disclosure arrived shortly after Amazon blocked Muse from shopping on its website. Users attempting to purchase goods through the assistant saw a message saying Muse was an unauthorized AI agent that violated Amazon’s conditions of use.
Amazon said third-party applications that make purchases for customers should operate openly and respect a service provider’s decision about whether to participate. The company said it had asked Meta to remove Amazon from Muse’s shopping experience.
Meta representatives did not answer emailed questions from Ars Technica. The report also said Wardle planned to discuss the vulnerability and other AI-assistant threats at the Objective by the Sea security conference in November.