A local app or command could steal the Muse account token on Mac

Your move: Meta shipped a hotfix more than 12 hours later. Update the Mac app

Security researcher Patrick Wardle showed on September 21, 2026, that any app or terminal command already on a Mac could change a hidden Muse setting and point its dictation endpoint at a server the attacker controls. Muse then sent the account token to that server, which gives control of the Muse account. The flaw needs code already running on the same Mac. It can't break in from the internet by itself. More than 12 hours after the report, Meta said it shipped a hotfix that patched the flaw. The Hacker News covered the same disclosure.

Why it matters

If you use Muse on a Mac, update the app. A stolen account token can reach the messages, email, and payments you connected to Muse.

Source: Ars Technica ↗

Published by Agent Log. The summary reports the linked source; “Why it matters” and the verdict are Agent Log's interpretation.

More Muse updates →