Meta Muse Mac App Hit by Zero-Day and 6.8 GB File Export

Meta announced Muse, its personal AI agent, on September 8. Just over three weeks later, on October 3, security researcher Patrick Wardle disclosed a zero-day in the Muse Mac app: anyone who can run a single terminal command on the machine can obtain the account token. The same disclosure also covered a separate finding, in which developer Peter James asked Muse for his own filesystem and received a 6.8 GB zip file in return.

Both findings were reported on October 3 by DEV Community. Wardle is named as the person who disclosed the zero-day, and Peter James as the developer who requested the filesystem export. The reports do not say whether Meta has responded to either finding, whether the vulnerability has been patched, or why Muse returned a 6.8 GB archive. No further details from the parties involved are included in the available material.

The account currently stops there: the zero-day in the Muse Mac app and the 6.8 GB filesystem export have both been made public. The report frames the two findings as decisions that developers will face if they build AI agents or let an agent onto their own laptop. It offers no additional information on the cause of either issue or on any impact beyond what the two findings themselves describe.