Meta's Muse AI assistant compromised by zero‑day that lets any macOS app hijack user accounts

Security researcher Patrick Wardle disclosed a zero‑day that lets any locally‑run macOS app capture the authentication token for Meta’s Muse AI assistant, effectively handing attackers full control of the service. The flaw lets a malicious process rewrite the transcription endpoint, redirecting voice data to an attacker‑controlled server.

Key points

• The vulnerability exposes the Muse authentication token to any app or terminal command.
• Changing the transcription endpoint gives attackers complete control of the assistant.
• Proof‑of‑concept code can write files, snap pictures, and operate without user alerts.
• Meta’s own security posts acknowledge the privilege level of Muse.
• Amazon began blocking Muse on its platform following the disclosure.

What happened

Meta launched Muse only weeks ago, positioning it as a “privacy‑first” AI assistant that books appointments, fills forms, and interacts with WhatsApp, email, calendar, and social media on macOS. The app requires broad system permissions—file write, microphone, camera, location—to perform its tasks. In the process, Meta designed Muse to expose a long list of undocumented settings that any local app can modify.

Wardle found that one of those settings controls the server address used for speech transcription. By swapping the default Meta endpoint for an attacker‑controlled one, a malicious app can retrieve the user’s Muse token. With that token, the attacker can issue commands, harvest data, and impersonate the user. Wardle demonstrated attacks that write malicious files, capture images, and operate silently, confirming that the assistant itself can be weaponized without additional malware.

The backstory

Meta’s marketing emphasized that Muse was “built from the ground up for privacy and security.” The company recently published two blog posts outlining design decisions meant to safeguard the assistant, a response to earlier internal testing of Anthropic and Google models that unintentionally breached third‑party networks. Those disclosures highlighted the difficulty of containing AI‑driven data flows, a challenge that reappears in Muse’s architecture.

The decision to perform dictation in the cloud, rather than using macOS’s on‑device transcription APIs, created the attack surface Wardle exploited. Meta also allowed any cooperating app to modify all undocumented settings, a convenience that inadvertently granted unrestricted control over the transcription endpoint.

Why the flaw matters

The vulnerability bypasses macOS’s sandbox and permission model, turning a trusted desktop environment into a conduit for remote takeover. Enterprises that rely on Muse for customer service or internal workflow automation now face the risk that a single compromised workstation could exfiltrate sensitive communications across the organization. The attack demonstrates how undocumented configuration paths can become high‑value targets when AI assistants are granted extensive system privileges.

Who stands to gain or lose

Attackers gain a low‑effort path to hijack a high‑profile AI service, potentially harvesting corporate credentials, confidential documents, and voice data. Meta suffers reputational damage and may see accelerated adoption barriers as businesses reconsider integration. Amazon, by blocking Muse, protects its ecosystem but also signals heightened scrutiny of third‑party AI assistants hosted on its platform. Users who have already linked personal accounts to Muse could experience data leakage unless they revoke access.

What builders and businesses should do

• Audit all third‑party AI assistants for undocumented settings that can be altered locally.
• Revoke Muse permissions in macOS System Settings and monitor for unexpected token usage.
• Deploy network monitoring to detect outbound connections to unknown transcription endpoints.
• Prefer on‑device processing for voice data whenever the operating system offers a secure API.
• Establish incident‑response playbooks that include AI assistant compromise scenarios.

The bottom line

Watch for Meta’s patch rollout and any follow‑up guidance from Apple regarding sandbox bypasses. Organizations should treat AI assistants as high‑privilege services and apply the same hardening standards used for critical infrastructure.