A major security gap has emerged in Muse, Meta's new macOS artificial intelligence assistant. Any locally installed app or terminal command can exploit a zero-day vulnerability to access the token that authenticates a user's account. Patrick Wardle, a macOS security researcher and founder of the Objective-See Foundation, discovered the flaw. The vulnerability undermines Meta CEO Mark Zuckerberg's claims that Muse was built from the ground up for privacy and security.

Muse can book appointments, complete forms, and handle customer service. It can also make purchases, create images, and connect to personal communication services like WhatsApp or email. The macOS application even creates custom tools when a task lacks a built-in integration. To perform these duties, users must grant Muse access to their accounts alongside sensitive macOS permissions. These include disk storage, location tracking, and camera access. Currently, there is no Windows version available.

The flaw allows any local process to modify a long list of undocumented Muse settings, bypassing default operating system permissions. One specific setting controls the endpoint address where speech transcription occurs. By changing this to their own server, attackers can capture the authentication token that grants full access to the Muse account. Wardle demonstrated proof-of-concept attacks that wrote malicious files and took photos without alerting the user. A proxy can also inject a malicious prompt, ordering the assistant to export an archive of all WhatsApp history.

A simple variation of the ClickFix technique is enough to trigger the compromise. Wardle used a simple terminal command to send a prompt to Meta's endpoint. His test asked how an unprivileged attacker could perform the action, to which Muse incorrectly replied that such an event was impossible. Meta has not yet responded to inquiries.

Meta published two blog posts regarding Muse's security and privacy design during the preceding weeks. Wardle noted that the decision to route dictation through the cloud, allowing Meta to log transcriptions, created this avoidable risk. macOS provides an on-device transcription path that would have completely prevented the exploit. He also criticized the choice to let any app control undocumented configuration settings. Wardle plans to discuss the vulnerability and wider AI-assistant threats at the Objective by the Sea conference in November.

Roughly 12 hours before Wardle disclosed the flaw, Amazon began blocking Muse from shopping on its platform. Amazon labeled Muse an unauthorized agent violating its terms of service and requested its removal. This block occurs alongside reports that internal model testing at Anthropic and Google led to unintended breaches of external networks, fueling the debate over safety standards for autonomous AI agents.