Meta patches Muse zero-day that let attackers hijack its AI agent

According to Ars Technica, the flaw relied on an undocumented Muse setting that let code already running on a user's machine redirect transcription processing from Meta's servers to an endpoint controlled by the attacker, giving that attacker access to the Muse account. Wardle built proof-of-concept attacks that used Muse to take photographs and write malicious files to disk, and the app did not alert the user in many cases.

Reported design decisions behind the flaw included running Muse dictation in the cloud instead of on-device, and allowing any application to control all of Muse's undocumented settings.

"We can manipulate the agent and leverage its privileges to do whatever we want," Wardle told Ars Technica. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself. At the very least, they should be thinking about security from the very start, and they are just not."

Meta had emphasized Muse's privacy and security features when it announced the agent earlier this month. David Singleton of Meta Superintelligence Labs said on X that the incident was a local privilege escalation attack rather than a remote exploit, so using it to cause harm would require malicious code already running on the user's machine under that user's account, which made the practical risk to Muse Mac app users quite low. He said the company issued a hotfix regardless.

The disclosure comes as Meta's AI agent faces scrutiny on other fronts. Amazon has blocked Muse from accessing its e-commerce platform and says Meta never obtained permission to do so. The launch has nonetheless drawn users: during its first 12 days, estimated downloads of the Muse mobile app reportedly outpaced ChatGPT's own 12-day debut in the United States and Canada, and Meta stock climbed 11 percent on Monday.