Meta issued a hotfix for a vulnerability in its Muse AI agent after a researcher showed that local software could redirect sensitive traffic and seize privileges granted to the assistant. The flaw turned Muse’s broad access into a potential path for stealing data or performing actions on a user’s computer.
Muse is available on macOS and can connect to services including WhatsApp, email, calendars and social accounts. It can also receive operating-system permissions for files, the microphone, camera, location and calendar. That combination makes weaknesses in its local controls unusually consequential.
There is no Windows version, so the reported exposure was limited to the Mac application and the permissions users had granted it.
A Local Setting Exposed a Powerful Token
Security researcher Patrick Wardle found that any local application or terminal command could reach Muse’s account token and modify undocumented settings. One of those settings controlled the endpoint used for transcription. An attacker could replace the legitimate destination with a server under their control, causing Muse to send the token automatically.
With that credential, Wardle demonstrated ways to control the agent and use its permissions. His proof-of-concept attacks wrote malicious files and took pictures, sometimes without alerting the user. The issue did not require the Muse model itself to be compromised; it relied on weak protection around the software that connected the agent to local and cloud resources.
Meta said the finding did not constitute a remote exploit and deployed a hotfix more than twelve hours after the research became public. That distinction matters because an attacker first needed some local execution path. It does not eliminate the risk, since malicious software and deceptive instructions frequently seek exactly that foothold.
Simple Commands Could Become an Entry Point
Wardle described a ClickFix-style scenario in which a victim is persuaded to paste a command into a terminal. The command could change Muse’s transcription endpoint and append an instruction that causes the agent to send a WhatsApp archive to the attacker. The user’s own action would begin the chain, but the agent’s saved access would magnify the result.
The vulnerability also meant an ordinary local application could modify the sensitive endpoint. That weak separation is central to the finding: software without Muse’s direct permissions could influence a component that possessed them. The assistant effectively acted as a proxy across security boundaries.
The demonstrations establish technical feasibility, not evidence of widespread exploitation. Wired’s report does not identify victims or a campaign using the flaw. The impact therefore depends on conditions around local access, user behavior and the permissions assigned to Muse. Even so, the proof shows how a small configuration weakness can expose several connected accounts at once.
Agent Architecture Expands the Security Boundary
Muse’s use of a cloud transcription service helped create the route Wardle exploited. He argued that on-device transcription would reduce the need to send audio and authentication material to a remote endpoint. That would remove this specific redirection opportunity, although it would not by itself secure every tool or account available to the agent.
The case illustrates why agent security cannot stop at model safeguards. An assistant may follow its intended instructions while surrounding applications, tokens and configuration channels remain vulnerable. Every connector and privileged setting becomes part of the attack surface, especially when the agent can act without requesting approval for each step.
Meta’s rapid patch closes the reported weakness, but it does not resolve the broader design problem. Agents are valuable precisely because they concentrate access and can move between services. Security controls must therefore protect not only what an agent is allowed to do, but also who can alter its destinations, credentials and operating assumptions.
