Zero-day turns Meta's Muse into a tool for attackers

What this is about

Security researcher Patrick Wardle disclosed a zero-day in Meta Muse on September 22, 2026. According to his analysis, any locally running process on a Mac can change an undocumented Muse setting: the server to which voice recordings are sent for transcription. An attacker can use this to intercept the Muse account token and remotely control the assistant.

This is especially serious because Muse may receive access to files, camera, microphone, location, calendar, email, WhatsApp, and other services to perform its tasks. Meta had promoted Muse as being built from the ground up for privacy and security. The company did not answer Ars Technica's questions before publication.

What the zero-day actually does

Muse normally sends dictated instructions to a Meta server. Wardle says that apps and terminal commands without special macOS privileges can change the destination endpoint for that transmission. If an attacker's server is entered, voice data and the token used to authenticate the account pass through the attacker's infrastructure.

The hostile server can alter a legitimate instruction or add another one. Muse then executes it with permissions the user has already granted to the assistant. Wardle says he demonstrated attacks including writing malicious files and taking pictures. A simple ClickFix lure, in which a victim copies a terminal command, can be enough to start the attack.

Why it matters

Traditional malware has to overcome separate security barriers for the camera, calendar, or files. A hijacked assistant may already have those approvals. The flaw therefore turns a central convenience feature into an amplifier: minor local access can become control over many connected accounts and device functions.

Platform operators are also reacting to the risks of autonomous shopping agents. Amazon blocked Muse on September 20, according to Ars Technica, citing its conditions of use. That is not the same vulnerability, but it shows that external services do not automatically trust such agents. The practical lesson for organizations is clear: agent permissions should be separated, time-limited, and revocable.

In plain language

Think of Muse as a personal assistant allowed to carry a ring of house keys. The zero-day lets any program in the house replace the address of the locksmith. The fake locksmith receives not only a copy of the ID but can also slip new jobs into the assistant's task list.

A practical example

An employee connects Muse to her calendar, email, and a shopping account. A fake support page persuades her to paste an alleged repair command into Terminal. The command needs no administrator privileges, but it changes the transcription endpoint. On the next voice request, the attacker receives the token and appends an instruction to send an archive of the last 100 messages to an outside server. It is not known whether this exact sequence has been abused beyond Wardle's tests.

Until Meta confirms a fix, users should not run Muse on devices holding sensitive data. Connected accounts should be detached and issued sessions or tokens revoked. Organizations should also check whether Muse is installed and whether unknown processes have modified its settings.

Scope and limits

• The technical description is based on Wardle's disclosure and independent reporting by Ars Technica; no CVE entry or complete vendor report was available on September 22, 2026.
• An attack first requires a local command or program to run. The flaw does not prove that arbitrary websites can take over Muse without user interaction.
• Meta has published neither the affected versions nor a fixed release. It is therefore not yet possible to verify reliably whether a particular device is protected.

SEO & GEO keywords

Meta Muse, Muse zero-day, macOS security, token theft, ClickFix, Patrick Wardle, Objective-See, AI agents, agent security, data access