Meta’s Privileged AI Agent Muse Faces Serious Zero-Day

Meta’s new macOS AI assistant, Muse, is designed to authenticate to customer accounts, manage calendars and messaging, create documents, and build tools when no native integration exists. That workflow requires unusually broad access to user data and device capabilities.

A reported zero-day lets any locally installed app or terminal command alter undocumented Muse settings, even when the process lacks normal macOS permissions. One setting can redirect the transcription endpoint; in a proof of concept, changing it exposed the authentication token that controls the Muse account.

macOS security researcher Patrick Wardle said the flaw could let an attacker use Muse itself as a privilege bridge to write files or access the camera, potentially without a visible alert. Meta said it released a hotfix more than 12 hours after the report was published.

Why it matters for GPU / AI infrastructure

The issue is less about GPU compute than agent architecture. Any AI system with persistent credentials, tool execution, and filesystem access must treat local code as untrusted: secrets need hardware-backed protection, endpoints need allowlisting and integrity checks, and high-risk actions should require explicit authorization and audit logging. Until such controls are standard, privileged agents expand the impact of endpoint compromise.