Muhammad Tayyab
Meta’s Muse Mac 0-day showed how a stolen agent token can reach email, WhatsApp, camera, and linked devices. A practical trust checklist for founders.
Meta’s Muse spent mid-September racing up the App Store charts as a personal AI agent that can email, shop, message, and act across your accounts. Within two weeks of launch, Amazon blocked it from shopping on Amazon.com — and macOS researcher Patrick Wardle showed that a local foothold on a Mac could steal the Muse authentication token and steer the assistant with every permission you had already granted.
This is not another abstract “AI safety” scare. It is a concrete reminder for founders and builders: once you hand a privileged assistant email, files, camera, or WhatsApp, its blast radius becomes the real product surface. Below is what happened, what was actually at risk, and a practical trust checklist before you connect the next agent to your life or your company stack.
Meta introduced Muse on 8 September 2026 as a personal AI agent for the US on iOS, Android, and muse.ai, with WhatsApp as a chat surface. Unlike a chatbot that only answers, Muse is designed to do work: book appointments, fill forms, make purchases, open a browser, and connect to email, calendars, payments, and messaging. Meta marketed a Muse Secure VM, a separate Sentinel permission broker, and the familiar claim that the product was “built from the ground up for privacy and security.”
On 21 September 2026, Wardle (Objective-See Foundation) publicly disclosed a zero-day in the macOS Muse client. His proof of concept, not-a-mused, showed that any process already running as the logged-in user — no admin rights, no macOS permission prompt — could rewrite an undocumented preference: endo_voyager_dictation_endpoint.
That setting controls where Muse sends voice dictation for cloud transcription. Point it at an attacker-controlled server, wait for the user to tap the microphone and dictate, and the client ships raw audio plus the Muse account authentication token to the attacker. From there, an adversary can proxy traffic back to Meta so nothing looks broken, inject prompts the agent trusts, or reuse the token to control Muse silently.
Wardle’s demonstrations included writing malicious files, taking camera photos with little or no user-facing alert, and — via the hijacked agent — pulling location from a linked iPhone. As he told Ars Technica: instead of building a full Mac malware stealer, you can “just leverage the AI assistant itself.”
Important precision: this was not a remote Mac exploit by itself. It required local code execution first. Meta framed it that way after shipping a hotfix. The uncomfortable addendum — which Wardle and Ars both stressed — is that ClickFix-style social engineering (trick someone into pasting a Terminal command) is already one of the most effective ways to get that foothold on Macs. “Local only” on paper can still be remotely delivered in practice.
As of late September 2026 reporting, no public CVE had been assigned; Meta treated the issue as a configuration defect and removed the mutable debug-style preference from production builds.
Roughly a day before Wardle’s disclosure, Amazon began blocking Muse from shopping on its site. Users saw warnings that an unauthorized AI agent violated Amazon’s Conditions of Use. Amazon said it had not authorized Muse, that the agent did not identify itself, and that third-party agents should respect whether a service wants to participate.
That dispute is about agentic commerce and platform consent, not the Mac token bug. Together, though, they answer the same founder question: who trusts your agent, and what happens when that trust is misplaced?
Personal agents only work if you grant them reach. Muse’s pitch — and the pitch of every serious competitor — depends on connectors and OS permissions:
macOS spent years building Transparency, Consent, and Control (TCC) so random Terminal commands cannot casually touch those resources. A privileged assistant you intentionally authorize undoes that default. If an attacker owns the agent’s session token or can inject into its command path, they inherit the agent’s privileges — not the narrow permissions of their dropper.
That is the architectural shift. Infostealers used to chase browser cookies and keychains one by one. Privileged agents concentrate the same value behind one trusted process and one token.
Use this as a pre-flight for any personal or team agent — Muse, a coding agent with MCP tools, an inbox copilot, or an internal “do-everything” bot.
Meta’s macOS hotfix landed quickly — on the order of about twelve hours after Ars Technica’s report — and David Singleton of Meta Superintelligence Labs described the issue as a local privilege escalation with “quite low” practical risk because malware already had to be running under the user account.
Speed matters. So does framing.
A hotfix that removes one mutable preference closes that hole. It does not shrink the underlying privilege concentration. It does not erase ClickFix as an initial-access path. And it does not replace the need for users to:
Update hygiene for agent users: turn on automatic updates; subscribe to the vendor’s security notes (or reputable reporters); after any agent-hijack story, confirm you are on the patched build before granting new connectors; and treat “we shipped a hotfix” as the start of your review, not the end.
For builders shipping agents: strip debug endpoints from production, sandbox settings mutations, log permission-broker decisions outside the model, and assume researchers will treat your assistant as malware with a UI if you give it camera, files, and messaging in one package.
Privileged assistants are useful. They are also a new class of high-value target. Muse’s launch week — chart momentum, an Amazon block, and a Wardle 0-day closed by hotfix — is a clean case study in why trust checklists beat marketing claims.
If you are evaluating agents for a product, a studio, or your own founder stack and want a second pair of eyes on architecture and blast radius, you can reach out via /#contact.
Muhammad Tayyab is a full stack and mobile engineer. He ships DripScore, an AI outfit-rating app on the App Store, under dawnapps.co.
OpenAI’s Dots keep working after chat ends. A practical builders checklist for permissions, connected apps, approval gates, and monitoring.
App Store companions now drive Claude Code, Codex, and Copilot from your phone. A builder’s checklist for E2E encryption, approvals, and multi-machine pairing.
Plugin4Shell showed SHA pinning alone can’t stop AI coding-agent plugin RCE. Here’s a practical builder checklist: versions, hosts, auto-updates, and hardening.