Back to feed
News Story
The Verge AI
2 sources

Meta patches Muse exploit that let attackers control the AI agent

Meta has patched a zero-day vulnerability in its Muse macOS app that could have allowed attackers to take control of the AI agent. The flaw, found by security researcher Patrick Wardle, exploited an undocumented setting to redirect transcription processing to an attacker-controlled endpoint, giving access to Muse accounts. The patch addresses risks stemming from design decisions like cloud-based dictation and unrestricted app control of settings.

SynthePulse Insight · AI deep reading

Muse Zero-Day: When an AI Agent Becomes an Attacker's Ready-Made Weapon

Version 1 · 1 source

Meta patched a zero-day in the Muse macOS app within hours of Ars Technica's report. The flaw, found by security researcher Patrick Wardle, requires local access but lets an attacker control the AI agent and access Muse accounts. Meta says real-world risk is low, but the incident exposes a deeper tension in AI agent security design.

  • Meta has released a patch for the Muse macOS app, fixing a zero-day that could let an attacker control the AI agent.
  • The flaw was found by security researcher Patrick Wardle and exploits an undocumented setting to redirect transcription processing to an attacker's endpoint, gaining access to Muse accounts.
  • The flaw requires local access to the user's device; the attacker must already be running malicious code on the user's machine under the user's account.
  • Wardle's proof-of-concept attack could take photos through Muse and write malicious files to disk, in many cases without alerting the user.
  • David Singleton of Meta Superintelligence Labs called it a local privilege escalation attack rather than a remote exploit, with fairly low real-world risk, but a hotfix was issued.
  • The flaw contrasts with the emphasis on privacy and security features when Meta announced Muse earlier this month.
Open section navigationHow the Flaw Works: A Chain Reaction Triggered by an Undocumented Setting

How the Flaw Works: A Chain Reaction Triggered by an Undocumented Setting

Meta has released a patch for its Muse macOS app after discovering a zero-day that could let an attacker control the AI agent. The flaw was found by security researcher Patrick Wardle. According to Ars Technica, the exploit used an undocumented Muse setting that let an attacker running local code redirect transcription processing from Meta's servers to their own endpoint, gaining access to Muse accounts.

The key to this attack path is that Muse dictation happens in the cloud rather than on-device, and that any app is allowed to control all of Muse's undocumented settings. Several design decisions reportedly combined to cause the flaw. The proof-of-concept attack Wardle developed to test the flaw let him take photos through Muse and write malicious files to disk, in many cases without alerting the user.

The Attacker's Leverage: No Need to Write Malware, Just Use the AI Assistant

Wardle told Ars Technica: "We can manipulate the agent and use its permissions to do whatever we want. So instead of writing a very comprehensive Mac infostealer, we can just leverage the AI assistant itself." This quote points to the core of the AI agent security problem: the permissions the agent itself holds can become a ready-made weapon for an attacker.

Wardle also criticized that Meta should at least have considered security from the start, but it did not. The context for this criticism is that the flaw contrasts with the emphasis on Muse privacy and security features when Meta announced the AI agent earlier this month.

Meta's Response: Local Privilege Escalation, Low Risk

Meta patched the flaw within hours of Ars's report. Meta claims real-world security concerns are minimal because the flaw requires local access to the user's device.

David Singleton of Meta Superintelligence Labs said on X that this was a local privilege escalation attack rather than a remote exploit, so it requires malicious code already running on the user's machine under the user's account, and the real-world risk to Muse Mac app users is fairly low. Singleton said that even so, they released a hotfix for the app to address the issue.

This response characterizes the flaw as a local attack requiring preconditions rather than a remotely triggerable vulnerability. But that characterization is the vendor's own account and lacks third-party verification.

The Bigger Picture: Muse's Rapid Expansion Alongside Controversy

The flaw emerged as Meta's AI agent is under scrutiny from multiple sides. Amazon recently blocked Muse from accessing its e-commerce platform, claiming Meta never obtained its permission.

Still, Muse's launch has been a success for Meta. Reportedly, within the first 12 days, estimated downloads of the Muse mobile app in the United States and Canada surpassed ChatGPT's own 12-day debut. Meta's stock rose 11% on Monday.

These figures are estimates relayed by the report, and the specific context is not detailed in the source.

Unresolved Questions and Uncertainties

Whether the flaw has actually been exploited in a real attack is not stated in the source. The specific technical details of Wardle's proof-of-concept attack are also not fully disclosed. The specific reason and timing for Amazon blocking Muse from its platform are likewise not detailed.

Meta's claim of fairly low real-world risk is the vendor's own account and lacks third-party verification. The data showing Muse mobile app downloads surpassing ChatGPT is an estimate, relayed by the report. The specific date and context of Meta's 11% stock rise are not detailed in the source.

Credibility boundary

This article is based on reporting by The Verge AI, which cites Ars Technica's investigation and a statement on X by David Singleton of Meta Superintelligence Labs. The flaw's discovery, the patch release, and the attack mechanism are confirmed facts; the design decisions, proof-of-concept attack details, and Wardle's quotes are source claims; Meta's risk assessment is the vendor's own account and lacks third-party verification; the download and stock figures are estimates relayed by the report.

Insight takeaway

The core lesson of the Muse zero-day is not about patch speed, but about the security boundary of AI agents: when an agent holds permissions such as taking photos and writing files, and its settings can be controlled by any local app, an attacker does not need to write full malware to exploit the agent itself. Meta's "local privilege escalation" characterization is technically valid, but it cannot eliminate one fact: the permission design of an AI agent is itself an attack surface.

Sources for this version

  1. Meta patches Muse exploit that let attackers control the AI agentThe Verge AI

Primary report

The Verge AI

Primary source

Same-event coverage

Also covered by 1 sources

InfoQT2Meta Muse macOS Client Hit by Zero-Day Vulnerability Bypassing Apple's Permission Framework