Meta rushes patch for Muse flaw that gave attackers control of AI assistant

Meta has released an emergency update to its Muse macOS application after a security researcher uncovered a zero-day vulnerability that would have allowed attackers with local device access to commandeer the AI agent. The flaw exploited an undocumented configuration option in Muse, enabling malicious actors to reroute voice transcription requests away from Meta's infrastructure to an attacker-controlled endpoint, thereby compromising the user's Muse account and access.

How the attack worked#

Security researcher Patrick Wardle identified the vulnerability and demonstrated proof-of-concept exploits showing how the compromised agent could capture photos and write files to disk without user notification. Because Muse's voice processing happens in the cloud rather than locally, and because the system permitted any application to modify undocumented settings, attackers could essentially hijack the privileged AI assistant to perform arbitrary actions on the infected machine.

"We can manipulate the agent and leverage its privileges to do whatever we want," Wardle explained in comments to Ars Technica, noting that this approach proved far more efficient than traditional Mac malware development.

Design shortcomings#

The vulnerability stemmed from several architectural decisions that prioritized functionality over security. Conducting transcription remotely, combined with inadequate permission controls over Muse's internal configuration options, created an environment where local code execution could rapidly escalate to account compromise. Wardle emphasized that Meta's security stance fell short: "They should be thinking about security from the very start, and they are just not."

Meta's response and impact#

Meta patched the issue within hours of Ars Technica's report, with executives downplaying the real-world risk since the exploit required an attacker to already possess local system access. "This was a local privilege escalation attack, not a remote exploit," said David Singleton of Meta Superintelligence Labs on X, adding that while the patch addressed the concern, practical harm risk was limited.

The incident arrives amid heightened scrutiny of Muse following its recent launch. Amazon has already blocked the agent from its platform, claiming Meta lacked proper authorization, yet the app's debut has nonetheless proved commercially strong—surpassing ChatGPT's early download trajectory in North America during its opening two weeks and helping drive Meta stock up 11 percent on one trading day.