Security researcher finds a local zero-day letting an attacker hijack Meta's Muse Mac app

What happened

Security researcher Patrick Wardle found a zero-day in Meta's Muse macOS app that let an attacker with local code execution redirect Muse's cloud-based dictation processing to their own server, effectively hijacking the AI agent's account access — proof-of-concept attacks let him take photos and write malicious files to disk via Muse, often without alerting the user ("we can manipulate the agent and leverage its privileges to do whatever we want," Wardle told Ars Technica). Meta patched the flaw within hours of Ars Technica's report and said real-world risk was low since it required local access already ("a local privilege escalation attack, not a remote exploit," per Meta Superintelligence Labs' David Singleton on X), but the underlying design choices — cloud-based dictation, undocumented settings any app could control — drew criticism given Meta's own security/privacy framing at Muse's launch. Lands the same week Muse's early-adoption numbers (reportedly outpacing ChatGPT's own 12-day US/Canada debut) drove an 11% Meta stock jump and a broader chip-sector rally. (The Verge, citing Ars Technica)
Anthropic released Claude Opus 5.5, the first model in its 5.5 family, saying it matches the larger Claude Fable 5.1 on most work at about 40% lower running cost than Opus 5 API prices are $4 input and $20 output per million tokens (20% below Opus 5) with cache reads at $0.20, output is more than 30% faster, and Sonnet 5.5 and Haiku 5.5 are due "in the coming weeks"; it is Anthropic's first release since Amodei's call to pace the frontier. (Anthropic, TechCrunch, The Verge)
OpenAI released GPT-6 Sol and GPT-6 Luna, taking the Astra generation to cheaper tiers at half the API price of the GPT-5.6 versions OpenAI says Sol makes about half as many mistakes as its predecessor on an internal factuality evaluation, "reaching Astra-level reliability at much lower cost"; it landed about 90 minutes after Opus 5.5 and OpenAI's comparisons claim wins over Anthropic's Fable and Opus. (OpenAI, TechCrunch)
Meta's Nat Friedman said Muse was "definitely heavily inspired as a product by OpenClaw" after users found Muse's workspace files nearly identical to the open-source agent's, including a SOUL.md personality file Friedman insisted Muse was "built from scratch" and said the team "thought that Peter got those things exactly right," referring to OpenClaw creator Peter Steinberger. (TechCrunch)
Muse passed 2.5 million downloads by Monday 09-21, two weeks after its 09-08 launch, with about 359,000 daily active iPhone users in the US and Canada. Sensor Tower's preliminary data showed about 1.8 million US-Canada iPhone downloads in the first 12 days against about 1.3 million for ChatGPT over the same period; over 95% of Muse users also use Facebook. (Ynet)
Palo Alto Networks launched Unit 42 Continuous Frontier AI Defense on 09-22, an always-on service that uses Anthropic's Mythos models and OpenAI's latest GPT cyber models to find and validate exploitable vulnerabilities in customers' systems. The company says the models are "gated capability models" restricted from public use, run inside its own multi-model harnesses under human offensive-security experts; Calcalist names Claude Mythos 5 and GPT-5.6-Cyber. (Palo Alto Networks, Calcalist)
Reuters reported that Meta had been testing a "human concierge" behind its new Muse personal AI agent, letting human contractors place some of the phone calls the agent appeared to make on its own, and that Meta had rolled the feature back Internal messages seen by Reuters, as summarised by Gizmodo, show employees worried that sensitive details could reach human callers and one tester reporting a contractor "had made a racist reference"; a Meta Superintelligence Labs vice president called the test "a miss," and Meta said calling will roll out only "with the proper disclosures." (Reuters, Gizmodo)
Comscore's Q2 2026 AI Intelligence Report put ChatGPT at 50% of US AI-assistant prompt volume in June, down from 70% in January, while Google's Gemini rose from 17% to 30% and Anthropic's Claude from 2% to 11% The figures come from Comscore's US opt-in panels tracking seven assistants; the report also found growth on mobile now outpacing desktop. (Comscore, via Yahoo Finance)

Sources 13

The Verge, citing Ars Technica theverge.com high 0.882 generally reliable
Anthropic anthropic.com primary source
TechCrunch techcrunch.com high 0.886 no consensus
The Verge theverge.com high 0.882 generally reliable
OpenAI openai.com primary source
TechCrunch techcrunch.com high 0.886 no consensus
TechCrunch techcrunch.com high 0.886 no consensus
Ynet ynetnews.com solid 0.8
Palo Alto Networks paloaltonetworks.com unrated
Calcalist calcalistech.com unrated
Reuters reuters.com high 1 generally reliable
Gizmodo gizmodo.com solid 0.696 generally reliable
Comscore, via Yahoo Finance finance.yahoo.com mixed 0.517

Credibility ratings combine two public datasets: Lin et al. 2023, PNAS Nexus 2(9):pgad286 (CC BY 4.0) for the domain-quality score, and Wikipedia's perennial-sources list (CC BY-SA 4.0) for the reliability tier. A rating describes an outlet's general record, never this particular article. Unrated means absent from those datasets — not a judgement.

The Projection

Security researcher finds a local zero-day letting an attacker hijack Meta's Muse Mac app

What happened

Sources 13

The wider story