Meta's Muse AI assistant has serious 0-day
The gist
Meta patched a Muse zero-day after researcher Patrick Wardle showed malware could hijack the Mac app.
The flaw hit an assistant built to act on your email, calendar and purchases.
How it unfolded
- Sep 8, 2026Meta launched Muse as a personal AI agent that can send emails, book travel, shop and track goals.
- Sep 21, 2026Mac security researcher Patrick Wardle disclosed the Muse zero-day, posting on X that it lets "local malware/attackers invisibly hijack" a user's Mac, and published a proof of concept named not-a-mused on GitHub.
- Sep 22, 2026David Singleton of Meta Superintelligence Labs said shortly after midnight Tuesday that Meta had issued a hotfix, removing the setting that allowed the dictation endpoint to be changed.