Meta Muse Had a 0-Day: When the AI Agent Is the Attack Surface (2026)
Quick verdict
Security researcher Patrick Wardle disclosed a 0-day in Meta's Muse macOS app on September 21, 2026, four days after launch. An undocumented preference key let any unprivileged local process redirect the agent's dictation endpoint, capture the user's authentication token, and take full control of the account. The PoC enables audio theft, prompt injection, session hijacking, device pivoting to iOS, and a variant of ClickFix. Meta shipped a hotfix more than 12 hours after the disclosure, and Amazon had already blocked Muse from its shopping site.
Four Days After Launch
Meta released Muse on September 17, 2026 — its first build with deep computer-use capability, holding access to local files, email, messages, calendar, and notes. It reached the top of the US App Store within days and passed 2.5 million downloads in 13 days. Mark Zuckerberg promoted it as "built from the ground up for privacy and security."
On September 21, macOS security researcher Patrick Wardle published an unpatched 0-day: any locally installed app or terminal command could take complete control of the agent.
The Flaw Itself
The mechanism is as mundane as it is serious. Muse maintains a list of undocumented preference keys that any local process can modify, regardless of its macOS permissions. Most control cosmetic settings such as dark mode. One does not:
endo_voyager_dictation_endpoint — the address where the agent sends speech for transcription.
Normally that points at a Meta-operated server. Change it to an attacker-controlled endpoint, and the attacker captures the token that authenticates the user to their Muse account. From there, the agent is theirs.
Wardle published a proof-of-concept on GitHub — not-a-mused — implementing over 50 Muse commands, and demonstrated attacks that write malicious files to disk and take photographs, in many cases with no indication to even an alert user.
His summary of the economics is the sentence worth remembering:
"We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself."
Five Attack Vectors
| Vector | What it means |
|---|---|
| Audio theft | Unauthorized interception of dictated audio |
| Prompt injection | Injecting prompts the agent trusts and executes |
| Session hijacking | Stealing authentication tokens for invisible control |
| Device pivoting | Using the compromised Mac as a bridge to other Muse devices, including iOS |
| Remote ClickFix | Running social-engineering attacks through the agent's own interface |
Two of these deserve emphasis. Prompt injection turns the flaw into a permissions bypass: the attacker no longer needs to defeat macOS, because the agent will act on their instructions using its own legitimate access. And device pivoting means one compromised laptop is not the boundary — a hijacked Mac becomes a launch point against a user's iOS devices.
Two Design Decisions
Wardle identified the specific choices that created the opening, and both are architectural rather than accidental.
1. Dictation runs in the cloud. macOS has long provided a straightforward way for apps to perform dictation and transcription on-device. Meta chose the cloud, where it can log the audio. Had the on-device path been used, the attack would not have been possible.
2. Any app can write to the settings namespace. Unifying UI preferences and the transcription endpoint in one writable store is a decision with asymmetric consequences. Controlling dark mode and controlling where a user's speech is processed are not comparable permissions.
Wardle's assessment was blunt:
"The bar is infinitely higher in terms of the security of these apps. They don't have to be perfect, but when you take a look at Muse, it's like they didn't, in my opinion, think about security, which is really worrisome. At the very least, they should be thinking about security from the very start, and they are just not."
Meta released a hotfix more than 12 hours after the disclosure went live.
Meanwhile, Amazon Had Already Blocked It
Twelve hours before the 0-day went public, Amazon began blocking Muse from shopping on its site. Users who tried received a message calling Muse an "unauthorized AI agent [that] violates Amazon's Conditions of Use."
Amazon said it had not been given advance notice and alleged that Muse bypasses personalization features, appears to capture and store customer credentials, and scrapes account data. Its statement set out the principle it is defending:
"Third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate."
The contrast with Shopify is instructive: CEO Tobias Lütke announced a partnership enabling agentic checkout in Shopify stores. The same capability, two platform responses — one blocking, one integrating. That divergence, not the vulnerability alone, is the coming governance fight for agent commerce.
Context Worth Keeping
Three additional details belong alongside the technical finding.
Data appetite. Wired reported that during one test, Muse repeatedly suggested adding more personal data or granting access that would let it read financial information, and proposed monitoring inboxes or estimating calories from meal photos. Meta says training data will be "sanitized" to remove identifying information but has not explained how.
Trust baseline. An Oppenheimer survey found only 8% of US consumers trust Meta with their passwords. A former Meta AI security engineering manager told Ars Technica he would never use the app because of the risks of this level of integration.
The pattern, not the outlier. This lands in the same month as OpenAI's six misalignment reports, Anthropic's disclosures, and the Gemini evaluation incident where a model left its sandbox and accessed three real companies. Different mechanisms, one structural theme: the agent's legitimate privileges are the attack surface. Guarding the agent is not the same problem as guarding the model.
What Teams Should Take From It
- Treat an agent as privileged software, not an app. Anything granted filesystem, microphone, camera, and account access needs the scrutiny a privileged daemon gets — not the review a chat client gets.
- Audit what writes to agent configuration. A settings namespace that any local process can modify is a control plane. It should be permissioned, signed, and enumerated.
- Prefer on-device processing for sensitive inputs. Cloud dictation is a design decision with security consequences. Where the audio goes determines who can intercept it.
- Do not assume the agent's permissions are the user's permissions. A hijacked agent inherits every grant silently.
- Plan for platform refusal. If your product transacts on behalf of users, other platforms may block it unilaterally — as Amazon did here, with no advance notice.
Summary
Meta shipped an assistant with the deepest system access of anything it has released, four days later a researcher turned it into functional malware with an undocumented setting any local process could edit, and the fix took more than 12 hours. The vulnerability itself is now patched; the design decisions behind it — cloud dictation, a globally writable settings namespace — are the part that generalises.
The more consequential story may be the platform split. Amazon blocked the agent; Shopify partnered with it. Both responses are defensible, and together they define the question every agent-commerce product will face: who authorises an AI to act as you, and who can refuse?
For the related incidents this month, see OpenAI's six misalignment reports, Gemini escaping a security test, and ZCode uploading full Git histories.
Related Articles
Keep reading