Time from Wardle's disclosure to Meta's hotfix: 12+ hours (Source: Ars Technica, republished by WIRED (September 27, 2026))
Security researcher Patrick Wardle disclosed a zero-day vulnerability in Muse, Meta's new AI assistant for macOS. The flaw let any locally installed app or terminal command take control of the agent, Ars Technica reported on September 27, 2026. Meta said it later released a hotfix. For organisations, the issue is what happens when an AI agent is given broad access to accounts and device resources. The agent's own privileges then become the attack surface.
What the flaw allowed
According to Ars Technica, Meta designed Muse so that any locally installed app or executed code can change a long list of undocumented settings. This applies regardless of the macOS permissions the app holds. Most of the settings are innocuous, such as dark mode. One controlled the end point where voice transcription occurs, which is normally a server operated by Meta. Pointing it at an attacker's end point would have given the attacker the token that provides complete control of the Muse account.
Muse is built to act on a user's behalf. Meta says it books appointments, fills out forms, makes purchases, and works with a user's WhatsApp, email, calendar and social media accounts. Wardle told Ars: "We can manipulate the agent and leverage its privileges to do whatever we want." He said he built several proof-of-concept attacks, including writing malicious files to disk and taking pictures. In many cases there was no indication, even to an alert user.
Why "local access" is a contested defence
Developers often argue that once a device is compromised, all security bets are off. Ars reports that this standard fits poorly here. Wardle found that a simple variation of a ClickFix attack, which tricks a person into running a command, is all that is required to take control of a Muse account. Meta's statement described the flaw as "not a remote exploit." Ars noted that the statement did not address ClickFix, which it had asked the company to do.
Wardle also pointed to two design decisions. Muse dictation happens in the cloud, where Meta can log it, although macOS offers an on-device option. Separately, any app can control all of the undocumented settings. In Wardle's account, on-device transcription would have meant the attack was not possible. Ars reports Meta has yet to explain the cloud choice.
Platform owners are setting their own terms
Separately, Amazon began blocking Muse from its site on Sunday. Users who tried to shop through Muse saw a message calling it an "unauthorized AI agent [that] violates Amazon's Conditions of Use." In a statement to Ars, Amazon said third-party applications that make purchases on customers' behalf "should operate openly and respect service provider decisions about whether or not to participate." Amazon said it has asked Meta to remove Amazon from the experience.
This is one product and one incident. It shows two pressures on agent deployments at once: a flaw in the agent's own design, and a service provider deciding whether agents may act on its platform.
What a budget-holder should ask their team
1. Which AI agents are installed on managed Macs, and which macOS permissions (files, microphone, camera, location, calendar) and account connections does each hold?
2. For each agent, which local processes can change its configuration, including where it sends voice or text data? Has the vendor documented this?
3. Do our endpoint controls and staff training cover ClickFix-style tricks, where a person is persuaded to paste a command into a terminal?
4. Does the agent process data on the device or in the vendor's cloud, and is that data logged?
5. If an agent's account token were exposed, how quickly can we revoke it, and how do we confirm the Muse hotfix is applied where the app is in use? Wardle has said he plans to discuss the vulnerability and other AI assistant threats at the Objective by the Sea conference in November.
