On September 21, 2026, macOS security researcher Patrick Wardle disclosed a zero-day vulnerability in Meta’s newly launched AI assistant, Muse, revealing that any unprivileged local application or terminal command can hijack the agent’s undocumented settings, seize control of authentication tokens, and bypass fundamental operating system permissions.
The Architecture of an Over-Privileged Agent
Meta founder and CEO Mark Zuckerberg promoted Muse as a system built from the ground up for privacy and security. The macOS-exclusive application arrived a few weeks prior with sweeping capabilities designed to automate daily digital workflows. It books appointments, fills out forms, handles customer service, generates images, creates documents, and spins up ad-hoc tools on the fly when missing a required function.
https://x.com/finkd/status/2097402102477701478
To accomplish these tasks, users must grant the software deep access to restricted device resources. This includes writing files directly to disk, activating the microphone and camera, and monitoring precise location data and calendar events. Apple spent years engineering these operating system boundaries to protect users from rogue terminal commands and malicious local apps. Muse, by design, vaults right over those default defensive layers.
Exploiting the Undocumented Endpoint
The core of the vulnerability lies in how Muse handles its backend communications. According to disclosures by Patrick Wardle, founder of the Objective-See Foundation and author of The Art of Mac Malware, any installed app or terminal command can alter undocumented configuration parameters within the Muse application—specifically the server handling cloud transcription.
By redirecting that transcription endpoint through a local proxy, an attacker can capture the user’s authentication token and gain persistent, complete control over the Muse account. Wardle demonstrated that a ClickFix-style social engineering trick combined with a single unprivileged terminal command is enough to trigger the flaw. Instead of processing sensitive voice prompts entirely on-device—a measure Wardle noted would have neutralized the vector—Meta routed the transcription through cloud infrastructure while leaving the endpoint settings wide open to modification by any local process.
Meta did not answer questions regarding the vulnerability following the disclosure, despite publishing two separate security-focused blog posts over the preceding fortnight.
Ecosystem Backlash and Platform Defense
The security exposure immediately triggered defensive reactions, including Amazon blocking Muse from accessing its site. Amazon stated that the AI agent violated its Conditions of Use and formally requested that Meta excise Amazon integration entirely from the Muse experience.
https://x.com/patrickwardle/status/2102045926474785265
While Meta positions Muse as an indispensable productivity layer deeply integrated with WhatsApp, email, calendars, and social accounts, the presence of a zero-day allowing arbitrary local process hijacking forces enterprise IT and platform operators to draw hard boundaries.
Wardle plans to deliver a full technical breakdown of the exploit vector at the upcoming Objective by the Sea conference in November, leaving security teams scrambling to assess local agent privilege models in modern desktop environments.
