Meta hot-fixes a Muse zero-day that turned its flagship agent into a Mac backdoor

breakthroughDeveloperLegalEnterprise

Tuesday, September 22, 2026

Confidence

High · — Ars Technica primary + 4 corroborating + confirmed vendor fix

Evidence

researcher disclosure + vendor patch + multi-outlet reporting

Researcher Patrick Wardle disclosed a zero-day in Meta's Muse agent on September 21; Meta shipped a hot-fix within 24 hours of the Ars Technica demo.

The details

Any unprivileged local process could redirect Muse's dictation traffic to attacker endpoints.
A ClickFix-style remote vector reached all Muse-connected devices, including iOS.

What it means

First weaponized zero-day against a major consumer AI agent at production privilege — Meta's Muse Secure VM failed at the config layer, not the model. Every enterprise piloting agents now has a named incident.

Researcher Patrick Wardle disclosed a zero-day in Meta's Muse agent on September 21; Meta shipped a hot-fix within 24 hours of the Ars Technica demo.

Any unprivileged local process could redirect Muse's dictation traffic to attacker endpoints.
A ClickFix-style remote vector reached all Muse-connected devices, including iOS.

Sources

Apply this today

The hands-on layer the brief points to: a workflow you can run, a tool to test, and today’s 60-second video.

Workflow of the day

Turn Unstructured Clinical Notes into a Structured Research-Ready Data Extract

Healthcare · tested · saves ~20 minutes per chart

Full walkthrough →

Tool watch

CUA-Bench by Vals.ai

CUA-Bench by Vals.ai: a computer-use eval that puts agents in front of six video games

Read the breakdown →

▶ Watch today’s 60-second brief →

In this issue

← Back to brief

Get the next one in your inbox

One daily brief. Every story gets a hype verdict.

No spam. Unsubscribe anytime.

On this page

The details
What it means

In this issue

← Back to brief

Stat of the Day

7▲

California data-center bills signed

The largest single-day state action on AI infrastructure to date, covering electricity cost recovery, water disclosure, and environmental review. Source

Today’s Take

Three of today's five stories are governance arriving on the same calendar week the exploit surface goes live — the UN chamber, a California statute, and a bank-sector warning — while a patched-in-24-hours Muse zero-day and a self-benchmarked Grok launch show the other side of the ledger. The pattern to hold: the labs are no longer arguing whether they should be regulated, only where and by whom. Enterprises that treated agent governance as a 2027 problem now have a signed statute, a Security Council session, and a named incident to point at, all inside one news cycle. Considered and passed: the Anthropic RIA rollout (single vertical-trade source, no AUM figures) and the Toyota $6.4B robotics estimate (Toyota's own primary release not directly linked).

— Agentic desk

Never miss a signal

Join professionals getting the daily AI brief every weekday morning.

No spam · Unsubscribe anytime

No sponsored verdicts
Sources linked
Corrections public