Meta patches Muse exploit found by Patrick Wardle

The flaw did not come from a single mistake but from several design decisions working together. Muse dictation ran in the cloud rather than on-device, and any app could control all of Muse's undocumented settings. Wardle's proof-of-concept showed that combination could let local code redirect transcription processing to an attacker's endpoint, and then use the agent's privileges to take pictures or write malicious files, often without alerting the user. That sits awkwardly beside the privacy and security emphasis Meta placed on Muse when it announced the agent earlier this month.

Meta moved quickly: it patched in the hours after Ars published its report, and David Singleton of Meta Superintelligence Labs argued the practical risk was low because the attack required local access under the user's own account. Still, the episode lands while Muse is already under scrutiny. Amazon recently blocked Muse from its e-commerce platform and says Meta never obtained permission, even as the launch drew strong early downloads and a stock climb.

The stakes come down to how much weight buyers put on that local-access caveat, and whether design choices like cloud dictation and broad app control over settings get revisited. Watch whether the hotfix closes the issue fully — or whether the scrutiny that already surrounds Muse continues to build.