Meta patches Muse AI assistant after discovery of macOS security flaw

Meta has issued security warnings and released a hotfix for its Muse personal AI assistant following the discovery of a serious zero-day vulnerability on macOS. The flaw, dubbed ‘Not-a-Mused’ by security researcher Patrick Wardle, could allow attackers to hijack a user’s Muse account.

By exploiting an undisclosed configuration item related to the assistant’s cloud-based voice dictation feature, an attacker could redirect voice data to a controlled server and intercept authentication tokens. Once an attacker gains these tokens, they can use the AI agent’s existing permissions to access sensitive connected applications, including email, calendars, and WhatsApp, without needing to deploy traditional malware.

Meta has addressed the issue by removing the problematic debugging configuration. The vulnerability highlights growing security concerns regarding AI agents that operate with persistent access to personal files, browsers, and accounts to perform autonomous tasks.