Meta Muse Mac zero-day: why you should pause the AI assistant

Image: Soft abstract security atmosphere (generated for this article). No Meta product art used.

If you installed Muse, Meta’s new macOS AI assistant, pause and read this before you give it another permission prompt. Ars Technica’s September 21, 2026 report by Dan Goodin, based on research from macOS security expert Patrick Wardle, describes a serious zero-day in how Muse stores tokens and settings. Separately, Amazon started blocking Muse from shopping on its site.

This is a home-Mac story. You do not need a security lab to act on it.

What Muse is supposed to do

Meta pitches Muse as an assistant that books appointments, fills forms, handles customer service, makes purchases, generates images, creates documents, and connects to apps and services. On Mac it can tie into WhatsApp, email, calendar, and social accounts. When a tool is missing, Muse can invent one on the fly.

To do that work, Muse needs broad access: account logins plus macOS permissions for files, mic, camera, location, calendars, and more. Apple spent years building TCC-style prompts so random apps cannot quietly grab those resources. Wardle’s point, as covered by Ars, is that Muse’s design effectively undoes a lot of that protection once the assistant is installed and trusted.

The zero-day in plain English

According to the Ars write-up:

• Any local app or terminal command can reach Muse settings, including ones Meta never documented for end users.
• One of those settings controls where transcription goes. Normally that is a Meta server.
• An attacker can point transcription at their own endpoint.
• When that happens, the attacker also gets the token that authenticates your Muse account.
• With that token, they can steer the privileged assistant (files, photos, connected services) instead of writing a full custom Mac stealer.

Wardle told Ars that a simple ClickFix-style trick (convincing you to paste a terminal command from a web page) can be enough. That matters because ClickFix is already a common social-engineering pattern for home users who think they are “verifying” something.

Meta did not answer Ars’s emailed questions in the article. Until Meta ships a clear fix, treat Muse as untrusted on a personal Mac.

Why the design choices make this worse

Two decisions stand out in Wardle’s analysis as reported by Ars:

1. Cloud transcription by default for Muse dictation, instead of keeping speech processing in Apple’s on-device path where possible.
2. Any local process can flip sensitive undocumented settings, not just a tightly controlled companion app.

Together, those choices turn “my Mac already has some malware” into “my AI assistant becomes the malware’s remote control,” and they also open a path that starts with a pasted terminal command rather than a deep exploit chain.

Amazon’s block (same week)

Roughly twelve hours before the disclosure, Amazon began blocking Muse from its site, calling it an unauthorized AI agent that violates Amazon’s Conditions of Use. Amazon says third-party apps that buy on customers’ behalf should operate openly and respect merchant decisions. That shopping fight is separate from the zero-day, but it is another reason not to lean on Muse for purchases right now.

What you should do today

If Muse is installed

1. Quit Muse completely (menu bar extras count).
2. Uninstall the app the normal way (Applications → move Muse to Trash, then empty when ready).
3. Revoke Muse access in account settings for WhatsApp, Google/Microsoft mail, calendars, shopping logins, and any other service you connected.
4. Review macOS Privacy & Security grants (Microphone, Camera, Files and Folders, Full Disk Access, Accessibility, Automation) and remove Muse leftovers.
5. Change passwords / revoke sessions for anything Muse could reach if you used it heavily after install, especially shopping and messaging.
6. Watch for Meta’s patch notes. Reinstall only after a credible fix, not after a vague “trust us” blog post.

If Muse is not installed

• Do not install it yet. Wait for Meta to patch and for independent researchers to confirm the settings endpoint can no longer be hijacked by arbitrary local code.
• Do not paste terminal commands from “verify you are human,” “fix your Mac,” or “enable the AI assistant” pages. ClickFix depends on that habit.

Treat AI assistants like privileged agents

Anything that can read your mail, drive your browser, and create tools on the fly is closer to a remote employee on your Mac than to a notepad widget. Give it the same skepticism you would give a new password manager or backup tool:

• Prefer assistants that keep sensitive speech on device when the OS already supports that.
• Prefer narrow permissions over “allow everything so it can be magical.”
• Prefer vendors who answer zero-day questions in public with timelines.

Muse’s marketing said it was built for privacy and security. The Ars / Wardle disclosure is a reminder to judge assistants by their failure modes, not their keynote demos.

Do not do that

• Do not keep Muse running “just for calendar help” while this is unpatched.
• Do not paste shell commands from random sites to “activate,” “verify,” or “speed up” Muse.
• Do not assume “my Mac has FileVault and a password, so I’m fine.” This issue is about a trusted assistant’s own token and settings surface.
• Do not dig for exploit samples. Uninstalling and revoking access is the whole home-user job.

Bottom line

Ars Technica reports that Meta’s Muse macOS app has a zero-day allowing local apps or a ClickFix-style terminal paste to redirect transcription and hijack the Muse account token, turning a highly privileged assistant into an attacker-controlled agent. Amazon is also blocking Muse shopping. For home Mac users the move is simple: uninstall or do not install until Meta patches, revoke connected accounts, and never paste mystery terminal commands from the web.