Meta’s Muse AI Assistant Rolled Out With a Serious Security Flaw

Meta’s new macOS assistant Muse was sold as built from the ground up for privacy and security. Security researcher Patrick Wardle found a zero-day that let any locally installed app or terminal command grab the token that authenticates a user’s Muse account — and, by redirecting where transcription runs, take complete control of the agent’s privileges.

Meta issued a hotfix more than twelve hours after the Ars Technica / WIRED report went live. Roughly twelve hours before Wardle’s disclosure, Amazon had already started blocking Muse from shopping on its site as an unauthorized AI agent. The story is not just a patch; it is a stress test of whether agentic assistants with deep OS and account access can ship without treating security as the product.

We’re grading Muse on the gap between the pitch and the design. Mark Zuckerberg hyped an assistant that books appointments, fills forms, handles customer service, makes purchases, and hooks into WhatsApp, email, calendar, and social accounts. To do that work, Muse needs exactly the permissions Apple spent years fencing off — disk, mic, camera, location, calendars. Once those gates open, the assistant becomes a high-value target sitting on top of everything a user cares about.

Wardle’s finding cuts through the marketing. Muse exposed undocumented settings that any local process could change, including the endpoint where transcription happens. Normally that is a Meta server. Point it at an attacker’s box and the auth token rides along — permanent control of the Muse account, with the agent’s privileges available to write files, snap photos, or ship WhatsApp archives, often with little or no user-visible alert. Wardle’s useful frame is that you can manipulate the agent instead of writing full Mac malware: the helper becomes the malware platform.

Two design choices made this cheap to exploit. Dictation went to the cloud, where Meta can log it, instead of macOS’s on-device path that would have closed the attack. And any app could drive those settings, not a tightly scoped partner surface. Meta’s later statement that this was “not a remote exploit” ducks the real threat model. Wardle showed a ClickFix-style social-engineering path — trick someone into a terminal paste — that lands the same outcome. Once agents hold god-mode privileges, “already compromised machine” is not an acceptable bar.

Amazon’s block lands in the same window for a reason. Agentic shopping without merchant consent collides with terms, fraud controls, and who owns checkout. Useful assistants that book and buy are worth building. They only stay useful if they identify themselves, honor platform rules, and do not dismantle OS defenses for convenience.

I’m watching whether Meta publishes a real postmortem on cloud transcription and open settings, whether Muse ever ships a Windows client with the same privilege model, and whether other agent vendors treat Wardle’s Objective by the Sea talk in November as a checklist instead of competitor drama. The trajectory if this becomes normal is consumer agents that look magical until the first local process owns them.

WIRED republished Dan Goodin’s Ars Technica report dated Sep 23, 2026. Wardle (Objective-See Foundation; former NASA/NSA) discovered the flaw; Meta’s hotfix followed the story; Amazon’s Conditions of Use block of Muse preceded disclosure by about half a day.