Meta patched Muse’s zero-day, but security teams still lack visibility into what the agent can access

Patrick Wardle disclosed a zero-day vulnerability in Meta’s Muse Mac app on Monday that let malware already running under a Mac user’s account hijack the agent’s authentication material with no special macOS permissions. The disclosure came as Muse passed 2.5 million downloads in its first 13 days, according to Sensor Tower. Wardle, founder of the Objective-See Foundation and a former NASA and NSA employee, demonstrated a compromised Muse session obtaining the location of a linked iPhone in Barcelona and initiating a Bluetooth Low Energy scan on the device.

The flaw let a local process change an undocumented setting to redirect Muse’s transcription endpoint and capture the authentication token used to control the agent. Meta hot-fixed the Mac app within a day by removing the setting from production builds, and David Singleton of Meta Superintelligence Labs called it a local privilege escalation, not a remote exploit. Wardle confirmed the patch on Tuesday and noted that a ClickFix-style lure could trick a user into pasting a command that would give a remote attacker the local execution the exploit required.

The incident also highlighted a separate enterprise problem: Muse can connect to services using credentials the user provides and act on the user’s behalf, while Muse itself gives enterprise security teams little central visibility into that access.

Muse can act with the access its users give it

Meta launched Muse on September 8 as a personal AI agent. It can send emails, book travel, fill out forms and make purchases on behalf of the user. Muse can also connect to external services and write custom connectors for services with APIs or CLIs.

Meta’s own security post, published September 8, described the dedicated VM each account gets in Meta's cloud. Credentials for connected services are stored in the user’s VM but outside the agent’s runtime cell, in a separate credential store. Sentinel, a host-side process, approves connector actions and network access. Wardle’s vulnerability did not defeat those cloud protections; it compromised the Mac client Meta released nine days later.

On September 17, Meta shipped a Mac version that, with the user’s permission, accesses local files, Messages, Notes and Calendar. The Mac app keeps running after the user closes the window. Meta says it plans to deliver a “Confidential VM” later in 2026 to restrict its own access to user data.

Muse gives the individual user an audit trail of what the agent did and plans to do. VentureBeat found no equivalent enterprise view: Meta’s launch documentation does not describe a SIEM audit export, IT admin console or DLP integration, and none surfaced in the consumer product VentureBeat tested. Meta did not respond to VentureBeat’s request for comment by publication time.

Muse adds a new path to shadow AI because the agent itself arrives prebuilt. An employee can install it, connect corporate email or other business services, provide API credentials, and give it access to connected systems within that user’s permissions.

Seven prompts built a working deal-tracking app without code

To test what an employee can build inside Muse without writing code, VentureBeat submitted seven plain-language prompts and documented every step in an accompanying investigative field report.

The first prompt was 79 words. Muse produced a working deal-tracking app called Deal Desk Lite with a data table, color-coded pipeline stages, and missing-field indicators. VentureBeat supplied no application code.

Six more prompts added data analysis, CSV import and validation, and a briefing feature. The app calculated $140,000 across four valued records, rejected invalid numeric input with a visible error and preserved blank fields rather than converting them to zero.

In a separate test, VentureBeat connected Muse to a live Google Sheet on a personal Google account, a sandbox with no corporate systems attached, and asked it to write deal data into a tab called “Deal Feed.” Muse completed the write in nine seconds, populating a row with the timestamp, headline, source and article URL.

Because VentureBeat used a personal account rather than a managed corporate environment, it did not test whether enterprise controls would detect or block that activity.

Taken together, the tests showed that Muse could turn plain-language prompts into a working business-style tool and take a write action in a connected service. They did not establish data leakage, evasion of enterprise controls, production use, or how often employees are using Muse this way.

API keys don’t show up in OAuth-only controls

By Meta’s design, Sentinel swaps the real token in at the network boundary, so the agent itself never holds the credential it acts with. But an API key an employee supplies to Muse does not create an OAuth grant, meaning controls that watch only OAuth grants will not see it. Security teams instead need visibility from sources such as API-key issuance logs, connector activity and the underlying service’s audit trail.