Meta Patches Muse Zero-Day That Gave Attackers Full Control of Macs

Meta has patched a zero-day vulnerability in Muse, its newly launched AI assistant, after researchers found the flaw could hand an attacker unrestricted control of a victim's Mac. The company confirmed the fix, acknowledging the bug would have allowed malicious actors to do essentially whatever they wanted on an affected machine. The disclosure lands just as Meta pushes Muse to consumers, and it raises hard questions about how quickly AI helpers are reaching users before their security is fully vetted.

The vulnerability belonged to a class of bug that security engineers treat as among the most dangerous: arbitrary code execution. In practice, an attacker who exploited it could run commands, read files, and move through a victim's system without the user's knowledge. Because Muse runs with deep permissions on the desktop, the assistant itself became the attack surface, not some peripheral app. Meta has not publicly detailed how the flaw was introduced or how long it sat in shipped code.

The timing is awkward for Meta, which has been racing to plant its flag in the crowded consumer AI assistant market alongside offerings from OpenAI, Google, and Anthropic. Each of those products asks for broad access to files, calendars, messaging, and the local file system, precisely the permissions that make a successful exploit so damaging. Security researchers have warned for more than a year that AI agents are being granted trust faster than vendors can prove they deserve it.

What makes this case notable is that the fix came after the product was already in users' hands. That sequence, ship first and patch later, is standard in software but carries more weight when the software can act on your behalf. A compromised assistant is not just a leaked document; it is an attacker with a standing invitation to your machine. Meta says the issue is resolved, but it has not said whether any users were affected before the patch went out.

The episode will likely sharpen scrutiny of how AI assistants request and use system-level permissions. Expect security teams to press Meta and its rivals for details on sandboxing, permission scoping, and how vulnerabilities are reported and disclosed. The open question is whether the industry can build assistants that are genuinely useful without also handing attackers a direct line into the devices they run on. Meta has not yet said whether it will publish a fuller technical account of the flaw.