Meta patched Muse’s zero-day, but security teams still lack visibility into what the agent can access

Patrick Wardle disclosed a zero-day vulnerability in Meta’s Muse Mac app on Monday that let malware already running under a Mac user’s account hijack the agent’s authentication material with no special macOS permissions. The disclosure came as Muse passed 2.5 million downloads in its first 13 days, according to Sensor Tower. Wardle, founder of the Objective-See Foundation and a former NASA and NSA employee, demonstrated a compromised Muse session obtaining the location of a linked iPhone in Barcelona and initiating a Bluetooth Low Energy scan on the device.