Meta Patches Muse Zero-Day That Let Local Code Hijack Its macOS AI Agent

Meta has patched a zero-day flaw in Muse, its macOS AI agent app, after a security researcher demonstrated that locally running code could seize control of the assistant. The fix landed following private disclosure by Patrick Wardle, a veteran macOS security researcher known for digging into Apple-platform defenses. The bug mattered because Muse, like most desktop AI agents, is built to accept instructions and process user data, so anything that hijacks its pipeline inherits that trust.

The vulnerability centered on an undocumented Muse setting that Wardle discovered during his analysis. That hidden switch let code already executing on the machine redirect the app's transcription processing away from Meta's servers and toward an attacker-controlled destination. In practice, this meant a malicious program running locally — whether delivered through a sketchy download, a compromised dependency, or another foothold — could quietly intercept audio the user expected to be handled by Meta's backend.

Transcription is one of the more sensitive functions an AI agent performs. Audio routed through a hijacked pipeline can expose meeting recordings, voice notes, and ambient speech the user assumed stayed inside the vendor's infrastructure. Because the redirection abused a setting Meta never documented, it would not have shown up in normal configuration reviews, and users had no obvious way to detect or disable it before the patch.

The disclosure adds to a rough stretch for desktop AI agents, which blend cloud models with local permissions to files, microphones, and the clipboard. Each new capability widens what a single bug can reach, and researchers have increasingly targeted the bridge between an agent's local client and its remote inference servers. Wardle's finding is a textbook case: the weak point was not the model itself but the plumbing connecting it to the user's machine.

Meta has not published a detailed advisory, and the company has not said how long the undocumented setting existed or whether anyone exploited it in the wild. Muse users on macOS should confirm they are running the patched build rather than assuming an automatic update installed it. The open question now is how many other quiet configuration paths sit inside agent apps, waiting for the next researcher to find them.

Wardle has a habit of surfacing macOS flaws that vendors would rather patch without fanfare, and his Muse write-up will likely draw scrutiny to how AI desktop clients handle transcription routing. Watch for Meta to publish more detail, for third-party security firms to test whether similar redirection tricks work in rival agents, and for whether the patch merely closes this path or rebuilds the underlying trust boundary.