Meta's Muse AI Agent Hit by Critical macOS Zero-Day Flaw

Overview

Meta’s newly launched desktop AI assistant, Muse, designed to streamline tasks ranging from calendar management to automated online purchases, has been heavily scrutinized following the discovery of a severe zero-day vulnerability. Marketed heavily as a privacy-first agent built from the ground up, the macOS application requires deep system integration and broad user permissions. However, architectural oversights in how the application manages internal configurations and cloud communications have created an opening for total system compromise.

Discovered by prominent macOS security researcher Patrick Wardle, the vulnerability allows unprivileged local applications and terminal commands to manipulate undocumented settings within the assistant. This bypasses fundamental operating system defenses established by Apple to protect sensitive hardware resources, such as cameras, microphones, and local file storage, turning the AI assistant itself into a potent vector for malware delivery.

Architectural Flaws and Endpoint Hijacking

At the core of the security breakdown is how Muse handles cloud communication and configuration updates. To function as an autonomous agent capable of proactive task execution, Muse requests extensive authentication tokens and grants itself deep access to user messaging platforms, emails, and social media accounts.

Rather than implementing strict sandboxing for internal state management, the application permits any locally running process to modify various configuration flags. While most of these settings govern benign user interface preferences, one critical undocumented parameter dictates the target endpoint URL where audio dictation and speech transcription are processed.

By executing a simple command or deploying a lightweight payload—such as a deceptive ClickFix social engineering attack—an attacker can alter this transcription endpoint to point to a server under their direct control. Once redirected, the server captures the user's authentication tokens. With these tokens secured, malicious actors gain complete administrative command over the victim's Muse account, inheriting all the powerful tool-use capabilities and service connections granted to the AI.

Expanding the Attack Surface: Proxy Injection

Once an attacker intercepts the communication stream, the proxy server can dynamically inject unauthorized prompts into the user's voice workflows. For example, a user speaking a routine request can unknowingly trigger background system commands, such as packaging and exfiltrating private messaging databases or writing malicious executables to disk. Because the AI assistant executes these tasks with its pre-authorized privileges, traditional operating system monitors may fail to flag the behavior as anomalous.

This architectural weakness highlights the unique threat model introduced by autonomous software agents. Unlike traditional applications that operate under strict, predictable execution paths, LLM-driven agents dynamically generate actions based on input context, making them significantly harder to secure if the underlying control plane is compromised.

Industry Fallout and Platform Pushback

The discovery has triggered immediate industry friction. Major e-commerce platforms, including Amazon, moved swiftly to block Muse from operating on their storefronts, citing violations of terms of service and warning that third-party autonomous purchasing agents pose unacceptable reliability and security risks.

Security experts emphasize that as AI agents gain deeper integrations with consumer operating systems, the bar for secure design must rise exponentially. Relying on cloud-based processing for sensitive transcription workflows—when robust native operating system APIs are available locally—introduces unnecessary vulnerability vectors that undermine user trust.