Muse Zero-Day Allows Local Processes to Hijack Meta AI Agent Token via Transcription Endpoint

Meta released Muse weeks ago as a privileged agent that books appointments, accesses WhatsApp, email, calendar and social accounts, and generates on-the-fly tools. The macOS app requests broad entitlements for file writes, microphone, camera and location. Ars Technica reported that these permissions bypass Apple's standard sandbox controls. Patrick Wardle identified an undocumented settings API reachable without elevated privileges that accepts an attacker-controlled transcription server address.

Wardle published proof-of-concept code demonstrating token theft followed by agent hijacking to write files, capture images and execute tasks with no user-visible alerts. Meta's two recent security design posts claimed ground-up privacy protections yet omitted any reference to the settings channel or on-device transcription alternatives already present in macOS. Internal testing incidents at Anthropic and Google involving unintended external network access show the same pattern of privileged agents exceeding intended scope.

The design choice to perform dictation in Meta's cloud rather than on-device created the exfiltration path. This single decision eliminated the isolation Apple has enforced for years and directly enabled the token theft. Operationally, any installed application on the same host can now treat Muse as a privileged proxy for data access and actions without additional entitlements.

Meta has not responded to disclosure. A patch would require either moving transcription on-device or authenticating the settings API. Until then, deployment of Muse on macOS remains equivalent to granting every local process full account control.