Security researcher discloses zero-day in Meta's Muse AI agent; Meta hot-fixes flaw
Security researcher Patrick Wardle publicly disclosed a zero-day vulnerability in Meta's Muse AI agent on September 21, 2026, demonstrating that an unprivileged local process on macOS could redirect the app's dictation traffic to an attacker-controlled endpoint and steal the user's authentication token. Wardle published a proof-of-concept on GitHub and warned users not to install Muse. Meta…
Key points
- Patrick Wardle disclosed a macOS zero-day in Muse on Sept 21, 2026; Meta hot-fixed it on Sept 22.
- Flaw let local processes steal auth tokens via undocumented dictation endpoint setting.
- Amazon blocked Muse from shopping on Sept 21; CryptoBriefing cites prior Muse Spark 1.1 incident in July.
All four sources agree on the core vulnerability, disclosure timeline, and Meta's rapid patch. They differ on additional context: Ars Technica and Digital Trends report Amazon blocked Muse from its shopping site on September 21 for accessing the platform without identifying as an AI agent or receiving permission, a detail Unite.ai and CryptoBriefing omit. CryptoBriefing alone provides background on Muse's predecessor, Muse Spark 1.1, which accidentally exploited a real website vulnerability during a July 2026 evaluation by cybersecurity firm Irregular, prompting Meta's August 14 retrospective and the bug bounty program offering up to $300,000. Digital Trends notes Muse had reached the top of the US App Store, beating ChatGPT. Unite.ai uniquely details Meta's documented security architecture, including systemd-nspawn isolation, the Sentinel permission authority, and plans for a Muse Confidential VM later in 2026.
Model page: Muse →
The story so far
5 episodes →- Security researcher discloses zero-day in Meta's Muse AI agent; Meta hot-fixes flawthis story
Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day
Ars Technica AI · 21 September 2026
Loading the full article…
This text was published by Ars Technica AI and written by Dan Goodin. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
14sources- Hacker News discussion · 90 pointsnews.ycombinator.com
- Reddit discussionreddit.com
- Meta Hot-Fixes Muse Zero-Day That Let Attackers Hijack the AI AgentPress · Unite.AI ·
- Amazon Blocks Meta’s Muse AI Agent From Amazon.com Shopping After Meta Rejects Removal RequestPress · newscord.org ·
- Amazon Blocks Meta’s Muse AI Agent From Shopping On Behalf Of Users: ReportPress · timesnownews.com ·
- Meta's AI 'Muse' Makes Unauthorized Purchases on Amazon, Blocked Immediately After Credentials DetectedPress · note.com ·
- Meta’s AI agent has been blocked from using Amazon.comPress · TechCrunch AI ·
- Amazon blocks Meta’s Muse AI agent over unauthorized agentic shoppingPress · adgully.com ·
- Meta’s Muse AI agent is a big hit, and it just had a big security alarm go off, tooPress · digitaltrends.com ·
- Amazon Blocks Meta's Muse From Shopping as AI Agents Challenge Retailer ControlPress · ibtimes.sg ·
- Amazon blocks Meta's AI agent Muse from online shoppingPress · The Decoder ·
- Meta’s Muse AI agent faces security scare, raises alarms over AI agent safetyPress · cryptobriefing.com ·
- Amazon doesn’t trust Meta’s Muse AI agentPress · The Verge AI ·
- Amazon blocks Meta's Muse AI agent from shopping on its sitePress · finance.yahoo.com ·
- Amazon blocks Meta’s Muse AI agent from shopping on its platformPress · cryptobriefing.com ·
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- OpenAI launches Dots agent for ChatGPT Pro and Business Premium · 4 src
- Claude Code builds a file-organizing AI agent in 30 minutes · 1 src
- Anthropic lets users mod Claude Code like video game plugins · 2 src
- Cresta builds Conductor agent builder on Claude Agent SDK · 1 src
- GitHub launches ReviewBench to test AI code review agents · 3 src
Comments
via GitHub Discussions