AI Risk Wire

Cases › security breach › LR-2026-0757

Meta Muse zero-day let attackers hijack AI assistant via hidden setting

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Status: fix reported

Severity moderate
Reported 21 Sep 2026
Developer and model Meta

No source states: loss or records, agent tool, could do, deployer, industry.

Meta's Muse, a personal AI agent with broad access on the Mac, had its dictation traffic redirectable through an undocumented setting. Any unprivileged process already running as the logged-in user could change that setting so dictated audio and prompts went to an attacker-controlled endpoint, where injected instructions and the user's authentication token could be captured. Security researcher Patrick Wardle published a proof-of-concept on September 21, 2026, and said he had not reported the flaw to Meta before going public. Meta shipped a hot-fix on September 22, 2026, and reportedly removed the vulnerable setting from production builds. No CVE or formal advisory was confirmed, and the sources do not state how many users were affected.

What happened

1 · What it reached or didIn the proof-of-concept, the redirect let the researcher read dictation, inject instructions and capture an account token.
2 · How it was caughtSecurity researcher Patrick Wardle found the flaw and published a proof-of-concept on September 21, 2026.

What was done

Fix reported

“Vulnerable setting removed from production builds; fix confirmed September 22, 2026”

Same developer, same risk, after the fix: LR-2026-0242

Risks

Credential and privilege abuse
Primary37 incidents
Data leaked or sent out
Also32 incidents
Hidden instructions hijack the agent
Also50 incidents
Rising: 6 vs 2.8 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Short-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data

Infrastructure / target

Multi-factor sign-in and password policy · Secrets scanning

Similar incidents

Meta Muse agentic assistant ingests and trains on non-users' contact data without consent2026-10-27
Meta Muse AI agent KVM escape vulnerability discovered before launch2026-10-08
WhatsApp help pages exposed hidden instructions for Meta chatbot2026-10-19
Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer2026-09-29

All cases of this kind ›

Evidence

No source states: what the AI was doing, what went wrong, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 5 items from the primary sources

What happened, in order

  1. September 8, 2026 Meta launched Muse as its personal agent.
  2. 14:42 UTC on September 21, 2026 Wardle began a public X thread disclosing the flaw.
  3. September 21, 2026 Wardle released a proof-of-concept demonstrating the flaw.
  4. 06:36 UTC on September 22, 2026 Wardle posted that the flaw had been hot-fixed.
  5. September 22, 2026 Meta shipped a hot-fix for the Muse zero-day.
Show every field, with its source and grade

The AI system

Developer
Meta
C one secondary source states it
What it was allowed to do
whatever access the user has granted the agent
C one secondary source states it
What it was for
personal AI agent
C one secondary source states it

What happened

Earliest source we hold
2026-09-21
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Who was responsible
the model provider
C one secondary source states it
What was done
Vulnerable setting removed from production builds; fix confirmed September 22, 2026
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK03
D inferred by us from the described behaviour, reason shown
secondary risks
RK04, RK01
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
C one secondary source states it

Notes on gaps

Meta's fix is reported by Unite.AI and The Hacker News (which could not confirm the change) and Wardle confirmed it; no Meta advisory exists.

LR-2026-0757 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON