{
  "version": "2",
  "id": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0",
  "title": "Meta patches Muse zero-day that let local code hijack its AI agent",
  "summary": "Security researcher Patrick Wardle found an undocumented Muse setting that could redirect transcription to an attacker's endpoint; Meta patched within hours and argues the practical risk was low because the exploit needed code already running on the Mac.",
  "body": "Meta has patched a zero-day vulnerability in its Muse macOS app after a security researcher demonstrated that an attacker could take control of the AI agent, according to The Verge's account of Ars Technica's reporting. The fix was issued in the hours after the Ars report was published, and Meta says the flaw has been addressed.\n\nThe bug was found by security researcher Patrick Wardle. Per the report, it relied on an undocumented Muse setting that let code already running on a user's machine redirect transcription processing away from Meta's servers and toward an endpoint the attacker controlled. That redirection, the report says, gave the attacker access to the Muse account.\n\nWardle's proof-of-concept attacks reportedly went beyond account access. The report states he was able to take pictures and write malicious files to disk through Muse, and that in many cases the app did not alert the user. In comments to Ars Technica, he described manipulating the agent and leveraging its privileges to do whatever the attacker wanted, meaning a comprehensive Mac stealer did not have to be written from scratch because the AI assistant itself could be used.\n\nThe report attributes the flaw to several design decisions rather than a single coding slip. Among them: Muse dictation happens in the cloud instead of on-device, and any app was able to control all of Muse's undocumented settings. Those two choices together are what the report describes as enabling the exploit path.\n\nMeta's response frames the severity differently. David Singleton of Meta Superintelligence Labs said on X that this was a local privilege escalation attack rather than a remote exploit, and that using it to cause harm would require malicious code already running on the user's machine under their own account. On that basis he described the practical risk to users of the Muse Mac app as quite low, while confirming the hotfix.\n\nThe timing is awkward for Meta. As the report points out, when the AI agent was announced earlier in the month, the company emphasized how Muse protects privacy and security; the exploit surfaced not long after. Wardle's quoted objection is that security should be considered from the very start rather than added later.\n\nThe agent is being examined in ways that go past this single incident. Muse was recently prevented by Amazon from reaching its e-commerce platform, the report states, and Amazon also asserts that permission for this was never given by Meta. Although that disagreement stands apart from the security flaw, it adds to an impression of a product whose integrations and limits are still being negotiated.\n\nFrom a commercial standpoint, the launch has done well. During its first 12 days, downloads of the Muse mobile app exceeded those of ChatGPT's own 12-day debut in the US and Canada, according to estimates cited in the report, and on Monday Meta stock rose 11 percent. Not audited numbers, those figures are presented as estimates and as a single day's market reaction.\n\nFor freelancers, designers and developers who run AI agents on their own machines, the mechanism matters more than the headline. The documented chain starts with local code execution, moves through an undocumented setting that any app could manipulate, and ends with transcription traffic being pointed at an attacker-controlled endpoint. Each link is a place where a desktop agent's trust boundaries can be weaker than its marketing suggests.\n\nThe cloud-versus-on-device choice is the part most likely to generalize beyond Muse. When dictation or transcription is processed remotely, the destination of that audio becomes a security-relevant configuration. If that configuration can be changed by other software on the same machine, the agent's account and its privileges become reachable from whatever else is running.\n\nThe detail that any app could control all undocumented settings is the second generalizable lesson. Undocumented settings are still attack surface even when they are not exposed in a user interface, and the report indicates these were not restricted to the app itself. That is a design question independent of whether the underlying code is otherwise well written.\n\nMeta's counterargument deserves weight on its own terms. A local privilege escalation requires an attacker to already have a foothold on the device, which is a meaningfully higher bar than a remote exploit reachable over the network. Singleton's statement that the practical risk was therefore quite low is a claim about likelihood, not about whether the bug was real.\n\nWhat the evidence does not establish is how many users were affected, whether anyone exploited the flaw in the wild before the patch, or how long the vulnerable behavior existed. The report describes Wardle's proof-of-concept work and Meta's fix, not a confirmed campaign against Muse users.\n\nIt is also unclear from the supplied material exactly which Muse versions were affected or how the fix is distributed. The report says Meta patched the vulnerability in the hours following the Ars report, but does not specify version numbers, rollout timing beyond that window, or whether users need to take any action.\n\nThe download and stock figures should be read with the same caution. They are described as estimates and as a single day's market movement, and the report does not tie them causally to the security incident. Strong adoption and a patched vulnerability can coexist without one explaining the other.\n\nThe practical takeaway for this audience is procedural rather than alarmist. If you run desktop AI agents that handle audio, files or account credentials, the questions worth asking are where processing happens, what other software can reconfigure it, and how quickly the vendor ships fixes. Muse's case shows a vendor can patch within hours once a researcher publishes, but it also shows the fix followed disclosure rather than preceding it.\n\nThat ordering is the real tension in the story. Meta says the risk was low and the response was fast, and both statements appear supported. Wardle's point is that the design choices that created the opening were made earlier, when security could have been built in rather than added after a researcher demonstrated the chain.\n\nFor now, the concrete facts are narrow: a zero-day in Meta's Muse macOS app, found by Wardle, involving an undocumented setting and cloud transcription routing; proof-of-concept attacks that took pictures and wrote files; a Meta patch within hours; and a company position that the exploit required local access. Everything beyond that, including real-world impact, remains unestablished in the available reporting.",
  "category": "ai",
  "language": "en",
  "datePublished": "2026-09-27T06:18:12.774Z",
  "dateModified": "2026-09-27T06:18:12.774Z",
  "eventDate": null,
  "sourcePublicationDate": "2026-09-22T11:53:58.000Z",
  "source": {
    "name": "theverge.com",
    "url": "https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent",
    "kind": "other-publisher"
  },
  "practicalImpact": "Editorial interpretation: developers and freelancers running desktop AI agents should treat cloud transcription routing and undocumented settings as security-relevant configuration, and should verify where audio and file operations are processed rather than assuming on-device handling. The Muse case suggests asking vendors how quickly they patch and whether settings are restricted to the app itself.",
  "limitations": "The evidence comes from a single report relaying Ars Technica's findings and Meta's public statements. No affected version numbers, rollout details, user counts, or evidence of real-world exploitation are provided. Download and stock figures are described as estimates and a one-day market move, not audited data, and are not causally linked to the security incident. Wardle's proof-of-concept results are reported, not independently reproduced here.",
  "keyPoints": [
    "Security researcher Patrick Wardle found a zero-day in Meta's Muse macOS app that used an undocumented setting to redirect transcription from Meta's servers to an attacker-controlled endpoint, per the report.",
    "Wardle's proof-of-concept reportedly took pictures and wrote malicious files to disk via Muse, often without alerting the user.",
    "Meta's David Singleton characterized it as a local privilege escalation requiring malicious code already running under the user's account, calling practical risk quite low, and said a hotfix was issued.",
    "The report ties the flaw to design choices: cloud-based dictation and allowing any app to control all of Muse's undocumented settings.",
    "The incident follows Meta's promotion of Muse privacy and security features and coincides with Amazon blocking Muse from its e-commerce platform over a permission dispute."
  ],
  "review": {
    "status": "source-reviewed",
    "checkedAt": "2026-09-27T06:18:12.774Z",
    "method": "Automated comparison against retrieved source text; not independent fact-checking.",
    "correctionNote": null
  },
  "sources": [
    {
      "id": 1,
      "url": "https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent",
      "publisher": "theverge.com",
      "title": "Meta patches Muse exploit that let attackers control the AI agent",
      "publishedAt": 1790078038000,
      "fetchedAt": 1790489864758,
      "hash": "8bd8bb6a437dd4dc4a1eea118bb8d1b90900b74738f5f14fb0a56b56f96a55ea",
      "kind": "other-publisher"
    }
  ],
  "claims": [
    {
      "claim": "A security researcher found a zero-day in Meta's Muse macOS app that used an undocumented setting to redirect transcription processing to an attacker-controlled endpoint.",
      "source": 1,
      "id": "claim-1",
      "url": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0#claim-1"
    },
    {
      "claim": "Proof-of-concept attacks reportedly allowed taking pictures and writing malicious files to disk through Muse, often without alerting the user.",
      "source": 1,
      "id": "claim-2",
      "url": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0#claim-2"
    },
    {
      "claim": "Meta's David Singleton said the issue was a local privilege escalation requiring malicious code already running under the user's account, described practical risk as quite low, and confirmed a hotfix.",
      "source": 1,
      "id": "claim-3",
      "url": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0#claim-3"
    },
    {
      "claim": "The report attributes the flaw to design decisions including cloud-based dictation and allowing any app to control all of Muse's undocumented settings.",
      "source": 1,
      "id": "claim-4",
      "url": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0#claim-4"
    },
    {
      "claim": "Amazon recently blocked Muse from accessing its e-commerce platform and claims Meta never obtained permission.",
      "source": 1,
      "id": "claim-5",
      "url": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0#claim-5"
    }
  ],
  "formats": {
    "html": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0",
    "markdown": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0.md",
    "json": "https://freelancenews.online/news/meta-patches-muse-zero-day-that-let-local-code-hijack-its-ai-agent-52b311a0.json"
  }
}