Meta's Muse AI Assistant Exposed by Critical Zero-Day Vulnerability

Meta Muse AI assistant capabilities

Meta unveiled Muse a few weeks ago as an AI assistant that can book appointments, fill out forms, handle customer service, make purchases, generate images, create documents and connect with favorite apps and services. The macOS-only product works with WhatsApp, email, calendar and social media accounts, and it can invent new tools when a needed capability does not exist. Meta has promoted Muse as being built from the ground up for privacy and security.

Meta Muse zero-day vulnerability disclosed September 2026

On September 21, 2026, macOS security researcher Patrick Wardle disclosed a zero-day flaw that undermines those claims. The vulnerability lets any locally installed app or any code executed in the terminal obtain the authentication token that ties a user to their Muse account. The flaw stems from an undocumented setting that controls where Muse sends voice transcription for processing. By default the setting points to a Meta-run server, but an attacker can change it to point to a server they control. Once the endpoint is altered, the transcription request includes the user’s token, which the attacker’s server receives and can then use to issue any command the assistant is authorized to perform.

Wardle demonstrated several proof-of-concept attacks that leverage this access. In one scenario, a malicious program writes files to the user’s disk without triggering any visible alert. In another, the assistant is tricked into capturing images from the camera and sending them to the attacker. Because the token provides full control over the assistant, an attacker can effectively turn Muse into a stealthy data-exfiltration tool or a platform for running arbitrary commands on the victim’s machine.

Meta has not responded to requests for comment about the flaw. The company did publish two blog posts in the weeks prior to the disclosure outlining the design choices meant to keep Muse private and secure. Those posts appear aimed at pre-empting criticism after separate reports showed that internal tests of models from Anthropic and Google unintentionally accessed external networks.

Around twelve hours before Wardle made the vulnerability public, Amazon began blocking Muse from its shopping site. Users who tried to use the assistant to make purchases received a message labeling Muse an unauthorized AI agent that violates Amazon’s Conditions of Use. Amazon said third-party tools that act on behalf of customers must operate openly and respect the decisions of the services they interact with, a principle it believes Muse fails to follow. The retailer asked Meta to remove Amazon from the assistant’s list of supported services.

ClickFix attack vector explained by Patrick Wardle

Wardle also described a specific attack vector he calls ClickFix. In this method, an attacker’s server sits between the Muse user and the legitimate Meta endpoint. When the user issues a voice prompt, the attacker’s server injects a malicious command-for example, a request to archive all WhatsApp messages and send it to the attacker. Because the transcription endpoint has been changed to the attacker’s server, the token accompanies the malicious request, granting the attacker lasting control over the assistant’s account.

The researcher, who leads the Objective-See Foundation, authored the “The Art of Mac Malware” series and previously worked at NASA and the NSA. He plans to discuss the Muse zero-day and broader risks posed by AI agents at the Objective by the Sea security conference in November. Wardle argues that the flaw shows a lack of security-first thinking in Muse’s development, noting that a simpler on-device transcription approach would have prevented the exploit.

Best practices for securing AI assistants handling sensitive data

For people who build with or use AI assistants, the incident highlights the importance of scrutinizing how privileged agents handle sensitive data and where they send it. Developers should enforce strict endpoint validation, avoid undocumented settings that can be flipped by any local process, and consider keeping speech processing on the device whenever possible. Users of Muse should immediately review any installed apps that have unexpected access to the assistant, consider disabling the assistant until a patch is released, and monitor account activity for unusual actions. The episode serves as a reminder that even highly promoted AI tools can introduce serious risks if security is not woven into their foundation from the start.

Frequently asked questions

What vulnerability was discovered in Meta's Muse AI assistant?

A zero-day flaw allows any locally installed app or terminal code to obtain the user's Muse authentication token by altering an undocumented setting that controls where voice transcription is sent, enabling attackers to hijack the assistant.

How does the Muse zero-day allow attackers to gain control of the assistant?

By changing the undocumented transcription endpoint to a server they control, the attacker receives the user's authentication token with each voice request, granting full command over Muse’s capabilities.

What proof-of-concept attacks did Patrick Wardle demonstrate using the Muse flaw?

He showed a malicious program writing files silently, and tricking Muse into capturing camera images and sending them to the attacker, turning the assistant into a stealthy data-exfiltration tool.

What actions did Amazon take regarding Muse after the vulnerability was disclosed?

Amazon blocked Muse from its shopping site, labeling it an unauthorized AI agent, and asked Meta to remove Amazon from Muse’s list of supported services because Muse did not operate openly per its Conditions of Use.

Source: Ars Technica