Meta patched a zero-day in its Muse Mac AI agent after security researcher Patrick Wardle found it could let an attacker with code already running on a Mac redirect dictation, capture voice prompts and a Muse authentication token, then control the agent.
The flaw involved an undocumented setting that controls where dictation is transcribed. Muse normally sends dictation to a server, but a locally running app or Terminal command could redirect it to a server controlled by an attacker. Wardle’s proof of concept also made Muse take photos and write malicious files, sometimes without alerting the user.
Meta’s David Singleton described the bug as a local privilege-escalation attack, not a remote exploit, and argued the practical risk was low because malicious code already had to be running on the Mac. Depending on user-granted permissions, Muse can access files, the microphone, camera, location and calendar.
