Meta’s Muse AI assistant contains a zero-day vulnerability that allows any locally installed app or terminal command to hijack the privileged agent and steal its authentication token, Ars Technica reported on 21 September 2026. The disclosure by macOS security researcher Patrick Wardle comes as Amazon began blocking Muse from its retail site, calling the agent an “unauthorized AI agent [that] violates Amazon’s Conditions of Use.”
Key points
- Patrick Wardle discovered a zero-day in Muse that lets any local app or terminal command capture the authentication token by redirecting the transcription endpoint
- A simple ClickFix attack is sufficient to take control of a Muse account, Wardle said
- Amazon blocked Muse from its retail site roughly 12 hours before Wardle’s disclosure, and has requested that Meta remove Amazon from the experience
- Meta representatives did not answer emailed questions about the vulnerability, according to Ars Technica
- Wardle criticized Meta for choosing cloud transcription over on-device dictation and for allowing any app to control sensitive undocumented settings
Wardle’s disclosure reveals token capture via transcription endpoint
Meta introduced Muse a few weeks ago as a personal AI assistant that books appointments, fills forms, handles customer service, makes purchases, generates images, creates documents, and connects with WhatsApp, email, calendar and social media accounts. The macOS app creates tools on the fly when needed, and there is no Windows version. For Muse to perform these tasks, users must grant it broad macOS permissions including writing files to disk, accessing the microphone and camera, and monitoring location and calendars.
Wardle, creator of the Objective-See Foundation and a former employee of NASA and the National Security Agency, found that Meta developers designed Muse so that any locally installed app or executed code can change a long list of undocumented settings. Most are innocuous, such as controlling dark mode. One setting, however, allows processes to change the endpoint where transcription occurs. Normally this is a server address operated by Meta. Attackers can redirect it to their own endpoint, capturing the token that gives complete control over the Muse account.
“We can manipulate the agent and leverage its privileges to do whatever we want,” Wardle told Ars Technica. “So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.” Wardle said his proof-of-concept attacks write malicious files to disk and take photos through the camera, in many cases with no indication to even an alert user.
Meta’s security claims face Amazon block and researcher criticism
Meta had published two posts in recent weeks documenting security design decisions for Muse, claiming it was “built from the ground up for privacy and security.” The vulnerability disclosure comes amid broader scrutiny of AI agent security, including revelations that internal testing of models from Anthropic and Google resulted in security breaches of external third-party networks.
Wardle said Meta made several design decisions that made his exploit possible. One was choosing cloud transcription over on-device dictation, which macOS has long supported securely. “At the very least, they should be thinking about security from the very start, and they are just not,” he said. “To me, the bar is infinitely higher in terms of the security of these apps. They don’t have to be perfect, but when you take a look at Muse, it’s like they didn’t, in my opinion, think about security, which is really worrisome.”
Amazon began blocking Muse from its retail site roughly 12 hours before Wardle’s disclosure. Users received a message saying Muse was an “unauthorized AI agent [that] violates Amazon’s Conditions of Use.” Amazon said in an emailed statement that it had requested Meta remove Amazon from the experience, and that “third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate.”
ClickFix attack sufficient for account takeover
Wardle found that a simple variation of a ClickFix attack — a technique that tricks users into infecting their devices — is all that is required for an attacker to take control of a Muse account. One attack method involves an attacker’s server acting as a proxy between the Muse user and Meta’s endpoint. The authentication token is sent to the malicious server automatically, giving the attacker permanent control of the Muse account.
Wardle said he will detail the vulnerability and other AI assistant threats at the Objective by the Sea security conference in November.
