Meta patches Muse flaw that let local code take over its AI agent on Macs

Meta has shipped a hotfix for its Muse app on macOS after security researcher Patrick Wardle showed that software running on a user's Mac could seize control of the AI agent and use its broad permissions. Meta says the risk to users was low. Wardle and Ars Technica, which first reported the flaw, argue the bug points to weak security thinking in a product that holds unusual access to people's accounts and devices.

What Muse can reach

Muse is Meta's new assistant that acts for the user. Meta says it books appointments, fills in forms, deals with customer service, makes purchases and connects to services such as WhatsApp, email, calendars and social accounts. It can also build its own tools when a task needs one. To do this on a Mac, users sign it into each service and grant it macOS permissions that the operating system normally withholds from apps, including disk writes, microphone and camera access, and location. Meta has promoted privacy and security as core to the assistant's design.

The flaw

Wardle, a Mac security specialist who founded the nonprofit Objective-See Foundation, found that Muse let any local app or command change many hidden, unlisted settings, whatever that program's own macOS permissions. Most were harmless interface options. One controlled the server that Muse sends dictated speech to for transcription. Pointing that setting at an attacker's server hands over the token that authenticates the user's Muse account, and with it full control of the agent.

From there, an attacker can inject instructions into the user's requests and have Muse act on them with its existing permissions. Wardle built proof-of-concept attacks that took photos and wrote malicious files to disk, often with nothing visible to the user. He said the approach spares an attacker from writing a full Mac data-stealing program, since the assistant already has the access. He also showed that a variant of ClickFix, a social engineering method that dupes people into infecting their own devices, is enough to trigger it.

He tied the bug to several design choices, including sending dictation to Meta's cloud rather than using the on-device transcription macOS already offers, and letting any app change every setting. "At the very least, they should be thinking about security from the very start," Wardle told Ars.

Meta's response

Meta released the hotfix after the Ars report went live, as The Verge reported. Meta Superintelligence Labs' David Singleton wrote on X that it was a local privilege escalation rather than a remote exploit, since it needs malicious code already running under the user's account, and that the practical risk was therefore quite low. Ars notes that Meta's statement did not address ClickFix-style delivery or explain the cloud transcription choice.

The bug lands during a busy launch. Amazon has started blocking Muse from shopping on its site, calling it an unauthorized agent, and says Meta never got its permission. The Verge reports that in the US and Canada, estimates put Muse's mobile app ahead of ChatGPT's when comparing each app's first 12 days of downloads.