Researcher reports Meta Muse flaw that exposes Mac control token

Mac security researcher Patrick Wardle reported a zero-day vulnerability in Meta's Muse agent that could let malware already running locally redirect the app's cloud transcription endpoint and capture the token controlling a user's Muse account. An attacker could then use the agent's extensive permissions to access data or act on the Mac without deploying a separate data-stealing payload. Wardle attributes the flaw to Muse's cloud-based dictation design. Meta had promoted a dedicated secure virtual machine for the agent but had not addressed the reported vulnerability when the article was published.