Meta has patched a zero-day vulnerability in its Muse macOS app after a security researcher demonstrated that an attacker could take control of the AI agent, according to The Verge's account of Ars Technica's reporting. The fix was issued in the hours after the Ars report was published, and Meta says the flaw has been addressed.
The bug was found by security researcher Patrick Wardle. Per the report, it relied on an undocumented Muse setting that let code already running on a user's machine redirect transcription processing away from Meta's servers and toward an endpoint the attacker controlled. That redirection, the report says, gave the attacker access to the Muse account.
Wardle's proof-of-concept attacks reportedly went beyond account access. The report states he was able to take pictures and write malicious files to disk through Muse, and that in many cases the app did not alert the user. In comments to Ars Technica, he described manipulating the agent and leveraging its privileges to do whatever the attacker wanted, meaning a comprehensive Mac stealer did not have to be written from scratch because the AI assistant itself could be used.
The report attributes the flaw to several design decisions rather than a single coding slip. Among them: Muse dictation happens in the cloud instead of on-device, and any app was able to control all of Muse's undocumented settings. Those two choices together are what the report describes as enabling the exploit path.
Meta's response frames the severity differently. David Singleton of Meta Superintelligence Labs said on X that this was a local privilege escalation attack rather than a remote exploit, and that using it to cause harm would require malicious code already running on the user's machine under their own account. On that basis he described the practical risk to users of the Muse Mac app as quite low, while confirming the hotfix.
The timing is awkward for Meta. As the report points out, when the AI agent was announced earlier in the month, the company emphasized how Muse protects privacy and security; the exploit surfaced not long after. Wardle's quoted objection is that security should be considered from the very start rather than added later.
The agent is being examined in ways that go past this single incident. Muse was recently prevented by Amazon from reaching its e-commerce platform, the report states, and Amazon also asserts that permission for this was never given by Meta. Although that disagreement stands apart from the security flaw, it adds to an impression of a product whose integrations and limits are still being negotiated.
From a commercial standpoint, the launch has done well. During its first 12 days, downloads of the Muse mobile app exceeded those of ChatGPT's own 12-day debut in the US and Canada, according to estimates cited in the report, and on Monday Meta stock rose 11 percent. Not audited numbers, those figures are presented as estimates and as a single day's market reaction.
For freelancers, designers and developers who run AI agents on their own machines, the mechanism matters more than the headline. The documented chain starts with local code execution, moves through an undocumented setting that any app could manipulate, and ends with transcription traffic being pointed at an attacker-controlled endpoint. Each link is a place where a desktop agent's trust boundaries can be weaker than its marketing suggests.
The cloud-versus-on-device choice is the part most likely to generalize beyond Muse. When dictation or transcription is processed remotely, the destination of that audio becomes a security-relevant configuration. If that configuration can be changed by other software on the same machine, the agent's account and its privileges become reachable from whatever else is running.
The detail that any app could control all undocumented settings is the second generalizable lesson. Undocumented settings are still attack surface even when they are not exposed in a user interface, and the report indicates these were not restricted to the app itself. That is a design question independent of whether the underlying code is otherwise well written.
Meta's counterargument deserves weight on its own terms. A local privilege escalation requires an attacker to already have a foothold on the device, which is a meaningfully higher bar than a remote exploit reachable over the network. Singleton's statement that the practical risk was therefore quite low is a claim about likelihood, not about whether the bug was real.
What the evidence does not establish is how many users were affected, whether anyone exploited the flaw in the wild before the patch, or how long the vulnerable behavior existed. The report describes Wardle's proof-of-concept work and Meta's fix, not a confirmed campaign against Muse users.
It is also unclear from the supplied material exactly which Muse versions were affected or how the fix is distributed. The report says Meta patched the vulnerability in the hours following the Ars report, but does not specify version numbers, rollout timing beyond that window, or whether users need to take any action.
The download and stock figures should be read with the same caution. They are described as estimates and as a single day's market movement, and the report does not tie them causally to the security incident. Strong adoption and a patched vulnerability can coexist without one explaining the other.
The practical takeaway for this audience is procedural rather than alarmist. If you run desktop AI agents that handle audio, files or account credentials, the questions worth asking are where processing happens, what other software can reconfigure it, and how quickly the vendor ships fixes. Muse's case shows a vendor can patch within hours once a researcher publishes, but it also shows the fix followed disclosure rather than preceding it.
That ordering is the real tension in the story. Meta says the risk was low and the response was fast, and both statements appear supported. Wardle's point is that the design choices that created the opening were made earlier, when security could have been built in rather than added after a researcher demonstrated the chain.
For now, the concrete facts are narrow: a zero-day in Meta's Muse macOS app, found by Wardle, involving an undocumented setting and cloud transcription routing; proof-of-concept attacks that took pictures and wrote files; a Meta patch within hours; and a company position that the exploit required local access. Everything beyond that, including real-world impact, remains unestablished in the available reporting.