Meta says it has patched a flaw in its Muse Mac app that could let malicious code take over a user’s assistant account and use access the user had already granted it. Security researcher Patrick Wardle reportedly demonstrated the consequence: making Muse write files and take camera photographs, in many cases without an obvious alert.
Muse is an AI assistant designed to carry out tasks, including booking appointments and making purchases. Those jobs can require access to connected accounts and protected Mac resources. The vulnerability could let code with fewer permissions borrow the assistant’s access, according to Dan Goodin’s reporting for Ars Technica. Its reach depended on what each user had authorized.
On September 22, The Verge reported that Meta Superintelligence Labs executive David Singleton said the company had issued a hotfix. Meta characterized the practical risk as low because an attacker needed malicious code already running under the user’s account. That requirement limits how an attack starts, but it does not explain away the additional access Wardle demonstrated.
Code already running as the signed-in Mac user could change an undocumented setting that told Muse where to send speech for transcription. In Wardle’s published proof of concept, the user then had to click Muse’s microphone and dictate, sending a request to the attacker-controlled destination. That request exposed authentication material, effectively a key to the Muse account. The attacker could then act through access already entrusted to the assistant.
“Local” describes where the malicious code must run. It does not mean someone must physically sit at the Mac, and administrator rights were not required. A malicious app or a command the user was tricked into running could provide the foothold. The flaw itself did not supply an attacker’s initial entry into a clean computer.
The resulting authority was control of the Muse account, not demonstrated administrator or root control over macOS. Files, microphones, cameras, calendars and connected services could become targets through Muse’s existing permissions. Neither the disclosure nor the reported demonstrations establish that every advertised capability, including purchases, could be exercised on every installation.
Ars reports Wardle’s controlled demonstrations of file writing and photography; these were not our own tests. The reporting does not specify which attempts required further approval or which permissions were already enabled. Those limits matter when translating account takeover into what an attacker could actually do.
A released fix does not confirm every Mac is protected
Meta’s hotfix announcement establishes the company’s response, but leaves users without a publicly documented way to identify a protected installation. The statement gives no fixed version or build number, and Meta’s Muse download page supplies no fixed-build identifier or confirmation instructions.
| Question | What the evidence establishes |
|---|---|
| What did an attacker need? | Code running as the signed-in user, followed by Muse dictation in the published attack chain. No administrator rights were required. |
| What was demonstrated? | Wardle reportedly wrote files and took photographs through Muse. Actual reach depended on permissions and connected services. |
| Who received the fix? | Meta says it issued a Mac-app hotfix. Public information does not establish which existing installations downloaded or installed it, or whether updates were enforced. |
| Was it used against real users? | The disclosure and cited reports identify research demonstrations, but no malicious exploitation. They do not establish that exploitation never occurred. |
The missing rollout details do not prove that Meta’s updater failed. Likewise, Meta’s quoted response does not say whether it examined activity records for abuse or invalidated potentially exposed account credentials. Closing the flaw and addressing any credentials already captured are separate questions.
Meta promoted Muse as built for privacy and security, according to Ars. Our read is that the meaningful test is whether those protections survive another app behaving maliciously: granting an assistant camera or account access should not silently grant the same authority to unrelated code. For existing Muse users, the immediate unresolved question is concrete: which installed build contains the fix, and how can they confirm they have it?