{"schema_version":"0.10.0","id":"LR-2026-0757","record_version":1,"title":"Meta Muse zero-day let attackers hijack AI assistant via hidden setting","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":62.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.12,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":3,"reports_independent":1,"reports_derivative":1,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"f706b552e1b26fdb78dad8e66d147dda2e7f47bec9b99b0c36eecd40ab4f2829"},"system":{"model_name":null,"model_version":null,"developer":"Meta","harness":null,"tools_granted":[],"permissions_scope":"whatever access the user has granted the agent","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"personal AI agent","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-21","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Meta's Muse, a personal AI agent with broad access on the Mac, had its dictation traffic redirectable through an undocumented setting. Any unprivileged process already running as the logged-in user could change that setting so dictated audio and prompts went to an attacker-controlled endpoint, where injected instructions and the user's authentication token could be captured. Security researcher Patrick Wardle published a proof-of-concept on September 21, 2026, and said he had not reported the flaw to Meta before going public. Meta shipped a hot-fix on September 22, 2026, and reportedly removed the vulnerable setting from production builds. No CVE or formal advisory was confirmed, and the sources do not state how many users were affected.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Vulnerable setting removed from production builds; fix confirmed September 22, 2026","precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK04","RK01"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":["privacy"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.unite.ai/meta-hot-fixes-muse-zero-day-that-let-attackers-hijack-the-ai-agent/","publisher":"Unite.AI","date":"2026-09-22","type":"press","title":"Meta Hot-Fixes Muse Zero-Day That Let Attackers Hijack the AI Agent - Unite.AI","archived_url":null,"attachment":"first_report"},{"url":"https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html","publisher":"The Hacker News","date":"2026-09-22","type":"press","title":"One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor - The Hacker News","archived_url":null,"independence":"independent"},{"url":"https://tech-insider.org/meta-muse-backdoor-unpatched-24-hours-2026/","publisher":"https://tech-insider.org/","date":"2026-09-22","type":"press","title":"Meta Muse Backdoor Patched Within 24 Hours [2026] - https://tech-insider.org/","archived_url":null,"independence":"derivative"}],"per_field_confidence":{"system.developer":"C","system.intended_use":"C","system.permissions_scope":"C","event.date_disclosed":"C","event.incident_class":"C","event.detection_method":"C","event.failure_class":"C","event.agent_involved":"C","event.responsible_party":"C","event.remediation":"C","impact.harm_class":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Security researcher Patrick Wardle said on September 22, 2026 that Meta had hot-fixed a zero-day vulnerability in Muse, its newly launched personal AI agent, following his public disclosure on September 21, 2026 that an unprivileged local process could redirect the Mac app’s dictation traffic to an attacker-controlled endpoint and invisibly hijack the agent."}],"system.intended_use":[{"source_index":0,"quote":"Meta launched Muse on September 8, 2026, introducing it as the company’s personal agent in a research blog post detailing the system’s security architecture."}],"system.permissions_scope":[{"source_index":0,"quote":"The README lists the potential consequences: capture of dictated audio and prompts, prompt injection into Muse, theft of Muse authentication material, and abuse of whatever access the user has granted the agent."}],"event.date_disclosed":[{"source_index":0,"quote":"Security researcher Patrick Wardle said on September 22, 2026 that Meta had hot-fixed a zero-day vulnerability in Muse, its newly launched personal AI agent, following his public disclosure on September 21, 2026 that an unprivileged local process could redirect the Mac app’s dictation traffic to an attacker-controlled endpoint and invisibly hijack the agent."}],"event.incident_class":[{"source_index":0,"quote":"Security researcher Patrick Wardle said on September 22, 2026 that Meta had hot-fixed a zero-day vulnerability in Muse, its newly launched personal AI agent, following his public disclosure on September 21, 2026 that an unprivileged local process could redirect the Mac app’s dictation traffic to an attacker-controlled endpoint and invisibly hijack the agent."}],"event.detection_method":[{"source_index":1,"quote":"Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21."}],"event.failure_class":[{"source_index":2,"quote":"Wardle’s proof-of-concept demonstrated that responses returned through the hijacked endpoint can carry injected instructions that Muse treats as legitimate output and acts on, a classic prompt-injection chain layered on top of a local exploit."}],"event.agent_involved":[{"source_index":2,"quote":"Wardle’s proof-of-concept demonstrated that responses returned through the hijacked endpoint can carry injected instructions that Muse treats as legitimate output and acts on, a classic prompt-injection chain layered on top of a local exploit."}],"event.responsible_party":[{"source_index":1,"quote":"Wardle argues Meta created the weak point itself by building its own way to handle dictation that sends the audio off the device, rather than using Apple's dictation, which runs on the Mac."}],"event.remediation":[{"source_index":2,"quote":"According to reporting, Meta has since removed the vulnerable setting from production builds, and researcher Patrick Wardle confirmed the fix on September 22."}],"impact.harm_class":[{"source_index":1,"quote":"From there, Wardle showed three things an attacker can do: read what the user dictated, add extra instructions that Muse trusts and acts on, and capture a token that signs in to the user's Muse account, then use it to read the account's chat history and control the assistant directly."}],"impact.severity":[{"source_index":0,"quote":"Anything the user had granted Muse access to, including messages, emails, and finances, would also be exposed to the local attacker, he wrote."}],"event.summary":[{"source_index":0,"quote":"Security researcher Patrick Wardle said on September 22, 2026 that Meta had hot-fixed a zero-day vulnerability in Muse, its newly launched personal AI agent, following his public disclosure on September 21, 2026 that an unprivileged local process could redirect the Mac app’s dictation traffic to an attacker-controlled endpoint and invisibly hijack the agent."},{"source_index":1,"quote":"It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta."},{"source_index":1,"quote":"From there, Wardle showed three things an attacker can do: read what the user dictated, add extra instructions that Muse trusts and acts on, and capture a token that signs in to the user's Muse account, then use it to read the account's chat history and control the assistant directly."},{"source_index":1,"quote":"Wardle said he did not report the flaw to Meta before going public."},{"source_index":2,"quote":"According to reporting, Meta has since removed the vulnerable setting from production builds, and researcher Patrick Wardle confirmed the fix on September 22."}]},"notes_on_gaps":"Not stated: date the flaw occurred, date detected, model name and version, harness, tools granted, number of users or devices affected, direct loss, records exposed, CVE (none reported), and whether the flaw was exploited in the wild. Meta's fix is reported by Unite.AI and The Hacker News (which could not confirm the change) and Wardle confirmed it; no Meta advisory exists. Judgements made: deployment and lifecycle set to production because Muse was launched publicly; root_cause set to integration and responsible_party to provider based on the setting and Wardle's argument; detection_method set to public_researcher; failure_class set to injection_triggered from the injected-instruction demonstration; severity set to moderate because access touched is bounded to what each user granted, with no stated count; I5 outcome got_around inferred from pre-disclosure without reporting; remediation controls_added J1 is a judgement. trigger, near_miss, and other fields omitted as not stated. Source 2 contains claims about Amazon and other products that are unrelated and not used. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"reached","text":"In the proof-of-concept, the redirect let the researcher read dictation, inject instructions and capture an account token.","quote":"From there, Wardle showed three things an attacker can do: read what the user dictated, add extra instructions that Muse trusts and acts on, and capture a token that signs in to the user's Muse account, then use it to read the account's chat history and control the assistant directly.","source_index":1,"grade":"C"},{"step":"caught","text":"Security researcher Patrick Wardle found the flaw and published a proof-of-concept on September 21, 2026.","quote":"Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.unite.ai/meta-hot-fixes-muse-zero-day-that-let-attackers-hijack-the-ai-agent/","https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html","https://tech-insider.org/meta-muse-backdoor-unpatched-24-hours-2026/"]},"analysis":{"sections":{"timeline":[{"text":"Meta launched Muse as its personal agent.","quote":"Meta launched Muse on September 8, 2026, introducing it as the company’s personal agent in a research blog post detailing the system’s security architecture.","source_index":0,"when":"September 8, 2026"},{"text":"Wardle began a public X thread disclosing the flaw.","quote":"Wardle published his findings in an X thread that began at 14:42 UTC on September 21, 2026, warning users not to install Muse and writing that serious zero-day flaws could let local malware or attackers invisibly hijack the agent.","source_index":0,"when":"14:42 UTC on September 21, 2026"},{"text":"Wardle released a proof-of-concept demonstrating the flaw.","quote":"Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21.","source_index":1,"when":"September 21, 2026"},{"text":"Wardle posted that the flaw had been hot-fixed.","quote":"In a post on his X profile timestamped 06:36 UTC on September 22, 2026, Wardle wrote “Hooray, hot-fixed!” and praised the speed of the patch.","source_index":0,"when":"06:36 UTC on September 22, 2026"},{"text":"Meta shipped a hot-fix for the Muse zero-day.","quote":"Security researcher Patrick Wardle said on September 22, 2026 that Meta had hot-fixed a zero-day vulnerability in Muse, its newly launched personal AI agent, following his public disclosure on September 21, 2026 that an unprivileged local process could redirect the Mac app’s dictation traffic to an attacker-controlled endpoint and invisibly hijack the agent.","source_index":0,"when":"September 22, 2026"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.unite.ai/meta-hot-fixes-muse-zero-day-that-let-attackers-hijack-the-ai-agent/","https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html","https://tech-insider.org/meta-muse-backdoor-unpatched-24-hours-2026/"]}}