Meta Releases Patch for Muse Zero‑Day That Could Let Attackers Hijack AI Agent

Meta’s Muse app, which lets users chat with a built‑in AI assistant on macOS, has just received a security update after a zero‑day flaw was uncovered.

Security researcher Patrick Wardle discovered that Muse’s hidden configuration could be manipulated by local code to reroute transcription traffic away from Meta’s servers. In effect, an attacker could hijack the AI agent and inject arbitrary commands.

The patch removes the exposed setting and hardens the communication channel between the client and the server. Users can download the latest version of Muse from Meta’s website or update via the App Store. Meta recommends installing the fix as soon as possible.

This incident underscores how even well‑intentioned AI tools can harbor vulnerabilities that enable complete takeover. Keeping software up to date remains the simplest defense against such exploits. The brief is inspired by public announcements this week.