Meta Muse zero-day opens a path to Mac backdoors

On 26 September 2026, security reporting disclosed a zero-day vulnerability in Meta’s Muse assistant for macOS that could turn the highly privileged AI agent into a route for a Mac backdoor. The flaw, identified by macOS security researcher Patrick Wardle, does not by itself let an attacker break into a clean computer from afar. It requires code to be run locally first, through malware, a malicious application or a social-engineering technique. But once that initial foothold exists, the reported weakness could give an attacker control over a Muse account and access to the services and device permissions connected to it.

Muse is designed as an agent rather than a simple question-answering tool. Meta says it can book appointments, fill in forms, deal with customer-service interactions, make purchases, create documents and connect to services including WhatsApp, email, calendars and social platforms. To perform those tasks, users may authenticate accounts to Muse and grant macOS permissions for protected resources such as files, the microphone, camera, location and calendars. That combination is central to the risk described by Wardle: one already authenticated assistant can concentrate access that an attacker would otherwise have to obtain service by service.

An undocumented setting with high stakes

According to Ars Technica’s account of Wardle’s findings, any locally running application or terminal command could modify a long list of undocumented Muse settings, regardless of the permissions held by that application or command. Most of those settings were described as comparatively harmless interface controls. One setting, however, controls the server endpoint used for dictation transcription. Under normal conditions, Muse sends dictation to a Meta-operated server. The vulnerability reportedly allows local code to replace that address with an endpoint controlled by an attacker.

That redirection creates two related risks. A server placed in the path of a user’s dictation can capture voice prompts. It can also receive the token that authenticates the user’s Muse account, according to the reporting. With that token, Wardle said an attacker could manipulate the agent and use the permissions and connected services that Muse already has. His proof-of-concept demonstrations included writing malicious files to disk and taking pictures, in some cases without signs that would be obvious even to an alert user. These demonstrations are reported research examples, not evidence that every Muse user has been compromised.

Not remote code execution, but a meaningful escalation

Meta said the issue was not a remote exploit. That distinction matters: the reported flaw does not provide an attacker with a standalone method to execute code on an otherwise uncompromised Mac. A prior local execution path remains necessary. Malwarebytes likewise noted that an attacker would first need malware, a malicious app or a social-engineering route. Yet the local-access condition does not make the issue trivial. Wardle and Ars Technica pointed to ClickFix-style scams, in which victims are persuaded by a website or unsolicited message to run commands, as one possible way that initial execution can occur.

The security concern is therefore one of escalation and consolidation. Conventional information-stealing malware generally has to search separately for browser data, credentials, documents, chat histories and other valuable material. A compromised AI agent may reduce that work if it already has authenticated links to communications services, cloud data and operating-system capabilities. The disclosed path does not mean Muse automatically exposes every connected account or every file. Its potential reach depends on the accounts, permissions and tools a specific user has enabled. Still, the incident illustrates why an agent with broad authority needs safeguards beyond those expected of an ordinary desktop application.

• Do not install or retain an AI agent with permissions and account connections that are not genuinely needed.
• Review linked email, messaging, calendar, cloud-storage and payment accounts, and remove unnecessary connections.
• Treat instructions to paste or run terminal commands from websites or unsolicited messages as suspicious.
• Keep macOS and security software updated, and watch for unexpected permission requests, reauthentication prompts or external file sharing.

A hotfix reported after disclosure

Ars Technica reported that Meta released a hotfix more than 12 hours after its article went live. The source material does not specify the technical changes in that fix, whether all affected versions were automatically updated, or whether users need to take additional steps. It also does not provide an independent technical verification of the patch. Users should therefore avoid assuming that a reported hotfix resolves every consequence of a prior account-token exposure. Where there is concern that a token or account may have been exposed, reviewing account sessions and linked services is a prudent general measure.

Wardle criticized two design choices that, in his assessment, enabled the exploit. First, Muse used cloud-based dictation transcription, even though macOS provides an on-device transcription option. Second, Muse allowed any local app or command to alter undocumented settings, including an endpoint used to process sensitive speech. Meta had promoted Muse as built with privacy and security in mind, but the reports raise questions about the level of isolation applied to sensitive configuration and about the security review of an agent entrusted with extensive access.

The episode also arrives as agentic software is being given a wider role in online transactions. Amazon began blocking Muse from shopping on its site shortly before Wardle’s disclosure, according to Ars Technica. Amazon described Muse as an unauthorized AI agent that violated its conditions of use and said it had asked Meta to remove Amazon from the experience. That dispute is separate from the zero-day, but it underscores a broader issue: assistants that act on users’ behalf affect not only the device owner, but also the services where they transact.

For Mac users, the immediate lesson is not that every AI assistant is inherently unsafe, nor that a locally installed program has unlimited power. It is that convenience features can create a valuable control point when they combine account authentication, device permissions and automated action. OWASP lists prompt injection, tool abuse, privilege escalation, data exfiltration, excessive autonomy, memory poisoning and sensitive-data exposure among major AI-agent risks. In English-speaking Mac workplaces and homes alike, limiting permissions at setup and revisiting them regularly is a more reliable defence than assuming an assistant will distinguish malicious instructions from legitimate ones.