Meta patches Muse’s Mac zero-day after an agent-hijack demo

On September 21, macOS researcher Patrick Wardle published a proof of concept for a flaw in Meta Muse’s Mac app. The issue centered on an undocumented dictation setting that a process running as the logged-in Mac user could change without extra privileges. If the user then dictated into Muse, the app could send the audio and prompt to an attacker-controlled endpoint.

Wardle’s proof-of-concept repository describes what that could enable: capturing dictated prompts, steering Muse with injected instructions, obtaining Muse authentication material, and using access the user had already granted the agent. The local process needed to be running first. From there, it could reuse the services and capabilities the user had connected to Muse instead of compromising each integration separately.

The attacker first needed code running on the Mac. Wardle said a ClickFix-style lure could persuade someone to run a command and create that local foothold. The lure supplies local execution; the Muse flaw then expands what that code can access. Wardle demonstrated the attack but did not report confirmed victims.

Meta’s David Singleton confirmed the hotfix on September 22. He said the fix removes the endpoint setting from production builds, and that the attack required malicious code already running under the user’s account. Meta also said the issue did not involve Muse’s servers or its Secure VM. Wardle later acknowledged the patch. The public confirmation does not identify a fixed app version, so Mac users should install the latest Muse update and verify that it completed.

The practical lesson is to treat an AI agent’s access as part of your security boundary. Keep the app updated, avoid commands copied from unfamiliar pop-ups or websites, and give an agent only the app and data access needed for the task. A cloud agent’s safeguards cannot prevent every risk created by a compromised client on a personal device.