Patrick Wardle disclosed a zero-day in Muse on 21 September — Meta’s macOS AI assistant, which has access to a user’s WhatsApp, email, calendar and social accounts. Any locally installed app or terminal command can seize the authentication token and with it full control of the account. Meta did not answer Ars Technica’s questions.
Key takeaways
- The flaw was found by Patrick Wardle, founder of the Objective-See Foundation and a former NASA and NSA employee
- The attack needs no system permissions — any app or terminal command will do
- The vector: swapping the transcription server address for the attacker’s own endpoint
- A simple variation of a ClickFix attack is enough to take over an account
- Meta did not respond to questions and has given no patch timeline
One unguarded setting
Muse lets any app or locally executed code — regardless of its macOS permissions — change a long list of undocumented settings. Most are harmless, like the dark mode toggle. One is not: the address of the server where speech transcription happens.
Wardle built working PoCs?PoC: Proof of concept — working code that shows an attack is feasible, without building it into a full tool. — writing malicious files to disk and taking photos, often with no signal to the user.
We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.
Patrick Wardle, founder of the Objective-See Foundation, speaking to Ars Technica.
Two design decisions
Wardle points to two. First: dictation runs in the cloud, where Meta can log it, even though macOS has long offered transcription that stays on the device — with that option the attack would have been impossible. Second: letting any app control every undocumented setting. Control over the interface is one thing, control over where a user’s recorded speech is sent is another entirely.
No need to own the device
The usual defence runs: once a device is compromised, all security bets are off anyway. It does not hold here. Wardle showed that a simple variation of ClickFix — a technique remarkably effective at tricking people into infecting their own machines — is all it takes. In another variant the attacker’s server sits as a proxy between the user and Meta’s endpoint and appends its own command to the voice prompt.
Why it matters
Mark Zuckerberg pitched Muse as a product "built from the ground up for privacy and security". The problem is not one bug but that an assistant with this breadth of access undoes protections Apple spent years building. The wider an agent’s privileges, the less it takes to hijack it — and the less an unverifiable security claim is worth.
What's next
- Meta has not addressed the report or given a patch date — the flaw remains open
- Wardle said he will present the vulnerability in detail at the Objective by the Sea conference in November
- Amazon blocked Muse from its site roughly 12 hours before disclosure and asked Meta to pull the assistant from its shopping experience
Sources
- Ars Technica — Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day
- The Verge — Amazon blocks Meta's Muse AI agent
