|
Getting your Trinity Audio player ready...
|
Just weeks after Meta launched Muse, its new AI assistant for macOS, with promises that the product was built from the ground up for privacy and security, a security researcher has demonstrated a working zero-day vulnerability capable of hijacking the assistant entirely, undercutting much of the confidence Meta projected when it introduced the product to the public. Patrick Wardle, a well-known macOS security researcher, disclosed the flaw and published a proof-of-concept exploit he dubbed not-a-mused, according to reporting from Ars Technica.
Muse was designed to be genuinely useful precisely because it has access to an unusually broad range of a user’s digital life. The assistant can book appointments, fill out forms, handle customer service interactions, make purchases, generate images and documents, and connect with services including WhatsApp, email, calendars and other social media accounts. Because the app runs on macOS, Meta also had to grant it permissions to operating-system-restricted resources that Apple has spent years locking down specifically to prevent unauthorized access, including the ability to write files to disk, access the microphone and camera, and monitor location and calendar data. That level of access is exactly what made Wardle’s discovery so consequential.
According to Wardle’s findings, any locally running, unprivileged software or terminal command on a Mac can modify an undocumented Muse setting that controls where the assistant’s voice transcription traffic gets processed. Under normal conditions, that traffic routes to a server operated by Meta. An attacker exploiting the flaw can redirect it instead to a server they control, exposing dictated audio and prompts in the process and, critically, capturing the authentication token tied to the user’s Muse account. Once an attacker holds that token, they gain effective control over the account and every permission Muse has been granted, without needing to build anything resembling a sophisticated custom malware tool from scratch. Wardle described the practical implication of the flaw directly to Ars Technica, saying attackers could manipulate the agent and leverage its own privileges rather than writing a comprehensive Mac malware stealer themselves.
Wardle said he built several working proof-of-concept attacks demonstrating what the vulnerability allows, including writing malicious files to disk and secretly capturing photos through the device’s camera, in some cases with no visible indication even to an alert, attentive user watching their screen. The exploit chain reportedly relies in part on a ClickFix-style technique, a well-documented social engineering method that tricks a user or an automated system into running a disguised malicious command framed as a routine fix or verification step, taking advantage of Muse’s ability to browse the web and follow instructions it encounters on a page, a known weakness Meta itself has previously acknowledged publicly.
The vulnerability is particularly striking given how much architectural effort Meta had put into preventing exactly this kind of compromise. Muse runs on the Muse Spark 1.3 model under the direction of Meta’s chief AI officer, Alexandr Wang, and each user’s assistant operates inside what the company calls a Muse Secure VM, a dedicated, isolated virtual machine meant to keep individual users’ agents and data separated from one another. Meta paired that isolation with a separate oversight system called Sentinel, which the company describes as the sole authority governing both connected services and all outbound internet traffic from the assistant. Rather than letting Muse handle real login credentials directly, Sentinel is designed to swap in surrogate tokens at the network boundary, meaning the assistant itself is never supposed to see actual passwords or payment details, and any critical approval, such as sending money or confirming a purchase, is meant to be surfaced directly to the user through the app rather than granted autonomously by Muse.
Despite that layered security design, Wardle’s exploit effectively bypasses the protections that architecture was meant to provide, precisely because the flaw exists in an undocumented configuration setting that sits somewhat outside the more heavily scrutinized parts of the system Meta’s Sentinel oversight was built to guard. As of the most recent reporting, Meta representatives had not responded to emailed questions about the vulnerability or provided a timeline for a fix.
The security disclosure arrived alongside a separate, unrelated setback for Muse. According to a report from GeekWire, Amazon began blocking the AI agent from shopping on its site starting Sunday, saying Muse had been accessing Amazon without properly identifying itself as an AI agent and that Meta had never received Amazon’s permission to operate the service this way on its platform. Users who now attempt to shop through Muse on Amazon are informed the agent violates the retailer’s Conditions of Use. Notably, Amazon’s decision was not a response to Wardle’s vulnerability disclosure and reflects a separate dispute over how AI shopping agents should identify themselves when interacting with e-commerce platforms, though the two stories breaking in close succession compounded a difficult week for Meta’s newest AI product.
Meta CEO Mark Zuckerberg has publicly framed Muse as a significant step toward what he describes as personal superintelligence, positioning the assistant as a flagship demonstration of Meta Superintelligence Labs’ broader ambitions since the division’s founding in mid-2025. That framing makes the current security controversy particularly pointed, since a product marketed specifically around trust, autonomy and deep access to a user’s personal accounts and devices now faces public scrutiny over exactly the kind of vulnerability that trust was meant to preclude.
For macOS users who have already granted Muse broad system permissions, the immediate risk described by Wardle’s research is real and, according to his own testing, exploitable with minimal technical sophistication once an attacker gains any form of local code execution on the machine. Until Meta issues a fix for the undocumented setting Wardle identified, security researchers are likely to continue treating Muse’s current permission model as a meaningful attack surface, particularly given how directly the assistant’s design trades convenience for the kind of deep system access that historically has made macOS security experts uneasy. Continuing coverage of how AI assistants are introducing new security risks is available on Business Tech. Additional detail on the vulnerability is available through Ars Technica’s original reporting, and further information on Muse’s features and security architecture can be found through Meta’s official AI site.
