-5.png?w=1024)
Meta has patched a security flaw that allowed malicious software already running on a Mac to hijack its Muse AI agent and potentially turn the assistant's existing privileges against its user.
Security researcher Patrick Wardle demonstrated the vulnerability in Meta's Muse macOS app, showing how an unprivileged local process could alter an undocumented setting and redirect Muse's voice-dictation traffic to an attacker-controlled server. Meta issued a hotfix within hours of Ars Technica publishing Wardle's findings.
The attack was not remotely exploitable and required malicious code to already be running under the victim's user account. But Wardle's research highlights a broader security problem as AI assistants gain access to files, applications, cameras, email and other resources that conventional malware may not be able to reach directly.
How attackers could hijack Meta Muse
Wardle found that Muse's macOS app uses cloud-based processing for voice dictation and includes an undocumented setting that controls the endpoint where the transcription occurs.
According to Ars Technica's detailed account of the research, locally running applications and commands could modify that setting without needing elevated macOS privileges.
An attacker who had already gotten malicious code onto a Mac could therefore change the transcription endpoint to a server under their control. When the user subsequently invoked Muse's voice-dictation feature, the attacker's server could intercept the request and manipulate the prompt before forwarding it onward.
More importantly, Wardle found that the redirected traffic could expose the authentication token used for the victim's Muse account. Obtaining that token could allow the attacker to interact with Muse while exploiting permissions the user had already granted to the AI assistant.
Wardle developed proof-of-concept attacks demonstrating the risk, including using Muse to write malicious files to disk and take pictures. The Register reported that the flaw could enable prompt injection, theft of authentication material, and abuse of any access the user had granted to Muse.
Meta characterized the practical risk as relatively low because exploitation required malicious code to already be running on the victim's machine. David Singleton of Meta Superintelligence Labs described it as a local privilege-escalation attack rather than a remote exploit and said the company issued a hotfix.
AI agents expand what a compromised app can reach
Muse presents a different security problem than a conventional chatbot because Meta designed the agent to take actions on users' behalf.
In its own technical breakdown of Muse's security architecture, Meta says the agent operates on a dedicated cloud computer and can run in the background, browse the web, and interact with third-party services. Users can connect Muse to systems such as email, calendars and other Meta apps, while additional connectors can extend its reach.
Those capabilities are useful when the person directing the agent is legitimate. They also make the agent's permissions more valuable if an attacker can influence or control them.
Security researchers are increasingly examining that problem across the agentic AI ecosystem. Researchers previously uncovered critical flaws affecting AI coding agents from Anthropic, Google and OpenAI that could expose credentials, enable remote code execution and compromise development workflows.
The problem also extends beyond vulnerabilities in the underlying AI models. Security teams increasingly have to account for the software surrounding them, including permissions, configuration files, authentication mechanisms, connected services and the systems that translate user requests into actions.
Researchers have already demonstrated how those capabilities can alter the speed and scale of attacks. In September, an AI-agent-driven attack campaign using hundreds of automated agents compromised at least 440 PaperCut server instances across 395 organizations in 48 countries.
Another recent vulnerability showed how compromising the surrounding infrastructure can put AI accounts themselves at risk. Researchers demonstrated a ChatGPT flaw that could expose data across user accounts, underscoring how AI security increasingly extends beyond the model itself.
What Muse users and security teams should do now
Meta's hotfix addresses the specific weakness Wardle demonstrated, but the bigger lesson applies to organizations deploying AI agents more broadly.
For Muse users, installing the latest version of the macOS app should be the first step. Because this attack required malicious code to already be running locally, maintaining endpoint protections and being wary of techniques that trick users into executing commands remain important defenses.
Organizations experimenting with Muse and other AI agents should also treat the permissions granted to those agents as part of their attack surface.
Security teams should:
- Inventory agent permissions. Know which files, applications, accounts, cameras, microphones, and cloud services an AI agent can access.
- Apply least privilege. Avoid giving agents access to services or data they do not need to perform their assigned tasks.
- Review connected services regularly. Remove connectors and permissions that are no longer required.
- Monitor agent activity. Treat unusual actions performed by an AI assistant as potential security signals rather than automatically assuming they originated with the user.
- Keep endpoint defenses in place. Agent security controls do not replace protections designed to prevent malicious code from running on the device in the first place.
Wardle's findings show why those controls matter. Local malware that might normally encounter macOS permission boundaries could become substantially more capable if it commandeers an AI agent the user has already authorized to access sensitive resources.
As AI assistants gain the ability to act rather than simply answer questions, security teams have another privilege boundary to protect: not just what the user can do, but what the user's AI agent has been authorized to do on their behalf.
For more on the risks of giving autonomous systems access to sensitive resources, eSecurityPlanet’s AI Agent Safety Checklist outlines practical controls for permissions, data access, human oversight, and incident response.