Meta Muse AI App Exposed to Local Malware via Zero-Day Vulnerability

• •Meta's Muse AI app has a zero-day vulnerability allowing local malware to hijack its functions.
• •The exploit requires local code execution, making it a privilege escalation issue rather than a remote attack.
• •The vulnerability compromises user data across multiple applications due to Muse's extensive permissions.

Meta's Muse AI assistant, launched on September 8, 2026, has been found to contain a zero-day vulnerability that allows local malware to hijack its dictation traffic. Security researcher Patrick Wardle disclosed the flaw on September 21, 2026, revealing that an undocumented setting enables malware to redirect audio data to an attacker-controlled endpoint. This vulnerability does not allow remote exploitation; an attacker must first execute local code on the victim's Mac. Once compromised, the attacker can intercept prompts, inject malicious commands, and steal authentication tokens. The Muse app has extensive permissions, including access to emails, messages, and calendars, amplifying the potential impact of the exploit. Meta's claims about Muse's security have been called into question following this discovery. The vulnerability is currently unpatched, and while it requires local access to exploit, it poses significant risks to users' data and privacy.