IA · 22 September 2026 · 5 min read
Muse Outpaces Early ChatGPT Downloads, but a macOS Zero-Day Exposes Meta's Agent
In brief: Just twelve days after launch, Meta's agentic assistant Muse climbed to the top of the US App Store, outpacing ChatGPT's early mobile adoption records in North America. However, that commercial momentum has been swiftly overshadowed by the disclosure of a critical zero-day vulnerability on macOS. Security researcher Patrick Wardle demonstrated that unprivileged local processes can redirect transcription endpoints, capturing authentication tokens and weaponizing the agent's broad system permissions to circumvent operating system protections.
by Team Mocchi's
Outpacing ChatGPT: The Swift Surge of System-Level Agents
Meta’s aggressive push into autonomous, agentic artificial intelligence has sent a noticeable ripple through the consumer landscape. Deployed initially across the United States and Canada on mobile and desktop platforms, the Muse assistant is designed to transcend the conversational prompt format. Instead, it positions itself as an autonomous digital proxy capable of scheduling meetings, completing forms, integrating with personal communications, and synthesizing ad-hoc software tools whenever an existing capability is missing.
Uptake across early markets has been swift. According to tracking data compiled by market intelligence provider Apptopia and reported by TechCrunch, the mobile version of Muse amassed 2.8 million installations within its first twelve days. Isolating North American iOS numbers to establish an apples-to-apples comparison with historic data, Muse achieved 1.8 million downloads compared to the 1.3 million recorded by ChatGPT over the identical post-debut timeframe. That trajectory pushed Muse to the number-one spot on the US App Store, accompanied by higher daily active user figures than OpenAI’s app commanded at the same milestone.
Elevated Privileges and the Architecture of Risk
Delegating full operational tasks to a local agent, however, radically reshapes the desktop threat model. To function as an end-to-end delegate on macOS, Muse requires an extensive array of operating system permissions. Users authenticate the software against third-party platforms such as email, calendars, and WhatsApp, while conferring broad system-level authorizations to write files to disk, monitor location data, and access the device microphone and camera.
Over several release cycles, Apple has steadily hardened platform defenses (notably through its Transparency, Consent, and Control framework, or TCC) to restrict unvetted third-party apps or terminal commands from interacting with sensitive hardware and user directories. Yet by design, Muse aggregates these disparate privileges under a single roof, effectively turning the agent into a consolidated gateway with deep reach into the physical device and connected services.
The Zero-Day Vector: Rerouting Transcription to Steal Account Credentials
This concentration of permissions quickly exposed a critical design blind spot. As detailed by Ars Technica, macOS security specialist Patrick Wardle, founder of the Objective-See Foundation, discovered an unpatched zero-day vulnerability residing inside Muse's desktop client.
Meta’s developers configured the application so that any unprivileged local process or basic terminal script can alter a wide range of undocumented configuration parameters. While many of these keys govern innocuous interface options, one specific setting controls the network address where recorded audio is sent for transcription. While this endpoint normally resolves to Meta's servers, local code can silently point it toward an arbitrary, attacker-controlled destination without prompting for administrative authorization.
Whenever the assistant subsequently initiates a transcription request, the outgoing connection transmits the user’s master authentication token directly to the hostile endpoint. Armed with this credential, an attacker gains full remote control over the agent. As Wardle demonstrated in proof-of-concept exploits, attackers no longer need to write complex native macOS malware to bypass platform sandboxes; they can simply instruct the hijacked Muse agent to capture photos from the webcam or write arbitrary payloads to disk, fully inheriting the legitimate authorizations the user already granted.
Mocchi's take
The security flaw uncovered in Muse brings the central dilemma of agentic software to light: an on-device autonomous AI is not a passive client, but a surrogate operator equipped with executive-level system privileges. For engineering teams evaluating or deploying autonomous agents within corporate environments, handing unrestricted access to file systems and peripheral inputs without verifiable, cryptographic isolation creates an intolerable attack surface. In our approach to custom software engineering, the principle of least privilege remains non-negotiable: autonomous agents must be enclosed in strict, verifiable sandboxes, ensuring that convenience does not inadvertently deliver a skeleton key to malicious actors.