Meta says hotfix addresses Muse Mac token flaw
Meta says it has issued a hotfix for a vulnerability in Muse for macOS that could let code already running as the logged-in user capture an authentication token and act through the user’s AI agent account. The flaw did not provide remote entry to a Mac, but controlled testing showed how an existing local foothold could gain access to capabilities and services that a user had authorised Muse to use.
David Singleton, an executive at Meta Superintelligence Labs, announced the hotfix on 22 September and characterised the issue as local privilege escalation with low practical risk, according to The Verge and Ars Technica. Meta had launched Muse on 8 September, while Mac security researcher Patrick Wardle publicly disclosed his proof of concept on 21 September.
No reviewed source reported exploitation against Muse users in the wild. The available evidence concerns Wardle’s publicly released proof of concept on researcher-controlled systems, not unauthorised access to real users’ data.
A local foothold came first
Wardle’s research found that another process running under the same user account could alter an undocumented Muse dictation setting without administrator privileges. According to Ars Technica and The Hacker News, changing that setting could redirect cloud transcription traffic away from Meta and expose the Muse authentication token carried with the request.
The attack therefore depended on code already running under the logged-in user’s account, or on the user executing an attacker-supplied command. It was not a drive-by exploit that independently compromised a Mac over the internet. The delivery method and the vulnerability’s technical precondition are separate issues: Wardle argued that social engineering could induce the necessary local execution, but the flaw itself still did not supply that initial access.
Once captured in Wardle’s controlled test, the token could reportedly be used to enter the Muse account, view chat history and submit commands. Reported actions included writing files, taking photographs and requesting some information or actions from linked devices. Tests also found limits. In one example, messages were drafted rather than silently sent.
Those findings do not establish that the Muse mobile clients contained the same weakness. The reported flaw concerned the Mac client, while the linked-device effects came from using the captured account token and the access already available through Muse.
Permission amplification, not administrator access
Meta’s terminology requires an important qualification. Calling the issue local privilege escalation does not mean the research demonstrated elevation to root or administrator privileges on macOS. The reported effect was that same-user code could inherit the reach of Muse, including the account functions, files, device resources and connected services that the user had allowed the agent to access.
That makes the issue better understood as post-compromise permission amplification. Malicious code running as a user can already cause harm, which supports Meta’s emphasis on the required local foothold. Wardle’s testing focused on the additional reach available after hijacking an agent designed to work across files, apps, browser tabs, Messages, Calendar and Notes with permission.
The practical difference would depend on each user’s configuration. The reviewed sources did not quantify how much more access Muse provided than ordinary same-user malicious code, and the demonstrated capabilities depended on the permissions and connectors granted to the agent. That leaves Meta’s low-risk assessment and Wardle’s impact demonstration focused on different parts of the same sequence: Meta highlighted the prerequisite, while the research highlighted what became possible afterwards.
The cloud controls were not shown to be broken
Meta’s security documentation says each Muse user receives a dedicated cloud virtual machine. It also says credentials are stored outside the core agent runtime and that a separate component called Sentinel authorises connector actions and network egress. Those descriptions come from Meta and are not an independent audit.
Wardle’s published research targeted the desktop client’s handling of dictation traffic and its account token. It did not demonstrate a compromise of Meta’s cloud virtual machine isolation or Sentinel. The distinction matters because a weakness in a client-side setting or authentication flow can undermine control of an account without proving that the service’s separate cloud isolation was defeated.
Meta said its hotfix addressed the reported flaw, but users and administrators were left without important remediation details. The reviewed sources did not identify a public security advisory, affected-version list, fixed build number, CVE or instructions explaining whether the update was automatic. There was also no independent patch analysis confirming that every relevant attack path had been addressed.
Australian availability was not confirmed in the reviewed launch material, so local exposure should not be assumed. More broadly, the unresolved questions are practical ones: which builds were affected, how users can verify that the hotfix arrived, whether existing account tokens were invalidated and whether Meta has telemetry indicating attempted exploitation. Until those details are published, the firm distinction is between a reported post-compromise path into an authorised AI agent and a remote Mac compromise, which the research did not demonstrate.
A local foothold and an agent’s user-granted reach belong in separate stages of the security analysis. For a broader grounding, consider The Hack Academy’s online cybersecurity training programme, whose listed subjects include cybersecurity fundamentals and penetration testing, with self-paced learning and practical exercises alongside theory in controlled, authorised settings.
