Meta patches Muse exploit that let attackers control the AI agent

Meta patched its Muse macOS app after security researcher Patrick Wardle found a zero-day that could let local attackers take control of the AI agent. Ars Technica reported the bug used an undocumented Muse setting to redirect transcription processing from Meta’s servers to an attacker endpoint — handing access to the Muse account.

This lands while Muse is already under retail fire from Amazon’s block and while Meta is pitching privacy and security as launch features. Agent privileges without agent hardening is how “assistant” becomes “malware with a friendly face.”

We’re not shocked, and that’s the problem. Wardle’s findings, as reported by The Verge and Ars, describe design choices that stack: Muse dictation in the cloud instead of on-device; any app able to control all of Muse’s undocumented settings; proof-of-concept attacks that took pictures and wrote malicious files to disk, often without alerting the user.

Wardle’s line cuts through the launch gloss: manipulate the agent, leverage its privileges, skip writing a full stealer. That’s the new endpoint calculus. You don’t need classic malware breadth if the assistant already has camera, filesystem, and account reach. Meta’s David Singleton of Meta Superintelligence Labs said on X this was local privilege escalation, not remote, and that practical risk was “quite low” because malicious code already had to be running under the user’s account — then confirmed a hotfix hours after the Ars report.

Technically Singleton’s distinction is real. Remotely wormable agent takeovers would be a different emergency. Local-only does not mean unserious. Once malware is on the box, an over-privileged, under-authenticated agent is a force multiplier — especially if it can silently redirect cloud transcription endpoints. “Undocumented settings writable by any app” is not a mature security posture for software Meta compared to privacy-forward launch messaging earlier this month.

Zoom out. Amazon blocked Muse from its storefront over unauthorized agent shopping and credential-adjacent concerns. Now a macOS exploit story hits in the same news cycle. Meta still claims strong early traction — estimated mobile downloads in the first 12 days reportedly outpacing ChatGPT’s US/Canada debut window, with Meta stock up about 11 percent Monday — but traction without a security culture just widens blast radius.

Our position: useful AI agents should ship with least privilege, on-device sensitive paths where feasible, authenticated control planes for settings, and user-visible consent when the agent touches camera, disk, or account-bound cloud services. Hotfixing in hours is necessary. Designing like security is optional until Ars calls is how the category earns regulators and enterprise bans.

I’m watching whether Meta publishes a fuller postmortem, whether Apple platform protections get cited as insufficient or bypassed, and whether other consumer agents audit undocumented preference surfaces this week. The trajectory if this becomes normal is simple: every agent is assumed hostile until its privilege model is boring and inspectable.

The Verge by Jess Weatherbed, September 22, 2026, citing Ars Technica’s report on Patrick Wardle’s research and Meta’s public response via David Singleton. Amazon block and download/stock figures as reported in the same Verge piece.