Meta Muse Turned One Local Foothold Into a Much Bigger Problem

An AI assistant that bundles your permissions can also bundle an attacker’s opportunities. Meta’s Muse vulnerability is a sharp example—and the interesting part isn’t the “zero-day” label.

Patrick Wardle found that locally running code could change an undocumented setting in Muse’s macOS client, redirect transcription traffic, and capture its authentication token. Suddenly, a foothold on the machine had a route into an assistant already trusted with connected accounts and protected resources.

That’s not an AI hallucination. It’s credential handling with a much larger blast radius.

One setting, three uncomfortable steps

According to [Malwarebytes’ account](https://www.malwarebytes.com/blog/news/2026/09/metas-muse-ai-assistant-has-a-zero-day-that-can-turn-it-into-a-mac-backdoor), the attack worked like this:

1. Local code changed the server Muse used for dictation transcription.

2. Muse sent voice prompts and its authentication token to the attacker-controlled destination.

3. The stolen token provided a route to misuse the assistant’s already-authorized access.

The attacker needed local execution first. This wasn’t a remote-code-execution bug that independently compromised a clean Mac. A malicious app, existing malware, or social engineering could supply that prerequisite.

That limitation matters. So does what happened afterward.

Dismissing this because “the attacker was already on the machine” treats security as one giant front door. macOS has per-application controls precisely because running one program shouldn’t grant access to everything another program can reach.

The Real Story

Muse’s selling point is also its security problem: it concentrates useful authority.

Meta launched Muse on September 8, 2026, for tasks including scheduling and shopping. In its technical description, Meta said the agent could operate unattended, launch subagents, build tools, and edit itself. Handy. Also quite a job description to hand an authentication token.

Wardle’s reported recommendation was blunt:

That’s a researcher’s risk judgment, not evidence that every installation was compromised. But the underlying concern deserves more attention than the familiar patch-and-move-on routine.

A small foothold should stay small. If another process can turn an assistant into a conduit for permissions it doesn’t possess, the assistant has weakened the boundaries users thought they were granting individually.

Public reporting doesn’t establish unrestricted administrative control, access to resources users never authorized, or takeover of every Meta account. Those would be stronger claims than the evidence supports.

The demonstrated claim is uncomfortable enough.

The hotfix is not the whole answer

[Ars Technica’s September 21 article](https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/) subsequently reported that Meta announced a hotfix more than 12 hours after publication. Calling this an unpatched zero-day indefinitely would be misleading.

Still, public reports don’t establish exact affected versions, independently verify the fix, or confirm criminal exploitation. They also leave an important question unanswered: were potentially exposed sessions invalidated?

Patching the leak and neutralizing credentials that already escaped are different jobs.

Put the boring security work first

Meta described private bug-bounty work, agentic red teaming, secure credential storage, and confirmation before sensitive actions. Those are company claims—not independent certification—and this disclosure shows why model safety cannot replace client security.

For developers building agents, my priority list is decidedly unglamorous:

• Treat endpoint configuration as security-sensitive, not cosmetic preference data.
• Prevent destination changes from carrying credentials across trust boundaries.
• Give connectors narrow scopes; summarizing email doesn’t require sending it.
• Enforce authorization outside the LLM, with downstream checks and meaningful approval.
• Make session revocation and connector disconnection fast.

That aligns with OWASP’s Excessive Agency guidance. No futuristic vocabulary required.

On September 29, Meta announced business connectors including QuickBooks, Shopify, Slack, and Stripe. The stakes now include accounting and customer workflows, although the reporting doesn’t establish that this flaw defeated those connectors’ approval controls.

My take: don’t judge an agent’s security by how impressively it reasons. Judge what happens when an ordinary component fails. Muse’s reported flaw made that test painfully concrete.