Meta's Muse Assistant Has a Zero-Day That Hands Attackers Your Whole Account

Meta’s Muse assistant shipped with a zero-day that lets any locally installed app, or a single pasted terminal command, steal the token that authenticates a user to their Muse account, per Dan Goodin’s report in Ars Technica on September 21. The researcher is Patrick Wardle, founder of the Objective-See Foundation and a former NSA malware analyst, who plans to publish the full technical details at the Objective by the Sea conference in November. The timing is pointed: roughly twelve hours before the disclosure, Amazon began blocking Muse from its store as an unauthorized agent. Two weeks into Muse’s public life, the assistant that Zuckerberg introduced as “built from the ground up for privacy and security” has an unpatched flaw that exposes everything it can touch.

How the Exploit Works

Wardle’s characterization is “privilege leverage” rather than classic malware exploitation: instead of breaking Muse, an attacker repurposes its powers. Muse made any local process able to change undocumented settings without macOS permission checks, and one of those settings controls which server handles Muse’s cloud transcription. Repoint it to an attacker’s server, and the next time the user speaks a prompt, the attacker receives both the dictated text and the auth token. Possession of the token means persistent account control, no further access to the machine required.

There is also a social-engineering variant that needs no software install at all. In the style of ClickFix scams, a single terminal command, pasted by a user who thinks they are fixing an unrelated problem, can silently inject prompts into Muse, with proof-of-concept attacks writing files to disk and taking photos, often with no visible indication anything happened.

What an Attacker Gets

The prize is the assistant’s own privilege set. Muse links to a user’s WhatsApp, email, calendar, social accounts, and purchase history, and holds access to the microphone, camera, files, and location. An attacker with the token inherits all of it: reading archives (the PoC exfiltrated a WhatsApp archive), sending messages, scheduling, and activating sensors on a device the user is still holding. This is the concrete downside of the assistant architecture: the product’s value proposition is consolidated access, and that consolidation inverts into single-token compromise. Every agent vendor building “one assistant for your whole digital life” is exposed to the same class of design failure.

The Design Choices That Made It Possible

Wardle’s critique targets two decisions Meta made before any attacker arrived. First, Muse uses cloud-based dictation instead of macOS’s on-device transcription, which is why user speech and a bearer token both traverse a redirectable network path. Second, Muse’s settings are modifiable by any local process without permission gates, an unexplained choice in an OS that enforces permissions for everything else. His summary to Ars: it looks “like they didn’t, in my opinion, think about security.” That lands directly against Meta’s own marketing, which included two security-themed posts in Muse’s first two weeks. Meta representatives did not answer Ars’s emailed questions, and no patch has shipped as of this writing.

What to Watch

The November talk will draw the biggest audience Objective by the Sea has had, but the practical questions come sooner. Whether Meta ships a patch and what it changes (settings access controls, or a move to on-device dictation) will show whether the fix is architectural or cosmetic. Whether enterprise MDM vendors start flagging Muse as a data-loss risk matters for adoption, because the token attack makes every Mac running Muse a liability an IT department can name. And for the industry, this is the first high-profile zero-day in a mainstream general-purpose agent: the pattern to watch is whether regulators treat agent tokens the way they eventually treated session cookies, as credentials whose compromise is a reportable security event rather than a bug in someone’s app.