A security researcher published a 0-day in Meta's Muse AI assistant: an undocumented config setting that any unprivileged local process can rewrite, letting already-present malware hijack dictation, inject prompts, and steal auth tokens. It landed one day after Amazon blocked the same agent from shopping on Amazon.com over a trust dispute. Neither story is exotic. Both come down to a check nobody was running: an unguarded config endpoint, and a missing standard for what an agent is allowed to do on a platform it doesn't own.
The 0-day: a config setting nobody was watching
Today, security researcher Patrick Wardle of Objective-See disclosed a 0-day in Meta's Muse AI assistant for macOS. Muse ships with an undocumented configuration setting, endo_voyager_dictation_endpoint, that any unprivileged local process can modify without administrator rights. Point it at a server you control, and you can intercept dictated audio and prompts before they ever reach Muse's servers, inject your own instructions into the agent, and grab authentication tokens tied to the user's account.
It isn't remote code execution by itself. It's an amplifier. Muse holds broad delegated permissions across files, apps, email, calendar, and connected devices, which means hijacking its input channel turns garden-variety local malware, the kind that's already sitting on a compromised machine doing nothing special, into something with agent-level reach across a person's digital life. Wardle's proof-of-concept is called "not-a-mused."
Why the timing matters
This 0-day landed one day after Amazon blocked Meta's Muse agent from shopping on Amazon.com, escalating a standoff that started when Amazon blocked (and Perplexity later appealed) an earlier AI shopping agent. That's not a vulnerability, it's a trust-boundary dispute: there's still no shared protocol for a platform to verify what an agent is authorized to do on a user's behalf, so platforms are drawing the line unilaterally, one blanket ban at a time. A 0-day and a platform ban hitting the same agent within 48 hours, while its download numbers are surging on the back of a big Meta push, is a compact case study in what "attack surface" actually means once an agent has broad permissions and broad distribution at the same time.
The pattern shows up elsewhere too
The same shape kept turning up elsewhere this run. Plugin4Shell, disclosed September 17 by AIR Security, is a zero-click RCE hitting four major AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Gemini CLI) because each one pinned plugin installs to a commit hash without ever verifying the checkout actually landed there. Two of the four are still unpatched. And on September 18, a security firm used Claude Opus 5 to chain an SSO misconfiguration with a Discourse RCE and walk into an OpenAI employee's account, resolved in 14 hours, but notable because the agent was the tool doing the attacking, not just the thing being attacked.
Different vendors, different bugs, same underlying gap: a check that everyone assumed was happening, and wasn't. A pinned commit nobody re-verified. A forum upload path nobody isolated from an SSO trust zone. A config endpoint nobody gated behind a permission check. An authorization standard between agents and platforms that doesn't exist yet.
What to actually do with this
If you're running agents in production, the useful question isn't "did I read about the Muse 0-day." It's "which of my own agent's boundaries am I actually checking, versus just assuming are fine." Config endpoints, plugin pinning, permission scopes, the things that look solved because nobody's poked at them yet.
That's exactly the gap we built Humanbound to find. It's open source, and you can point it at your own agent stack today.
pip install humanbound
References / Sources
- cybersecuritynews.com: Meta's Muse AI agent 0-day
- gbhackers.com: Meta's Muse AI 0-day
- iTnews: Security researcher says don't install Meta's Muse AI assistant
- GeekWire, Sept 21: Amazon blocks Meta's Muse AI assistant
- TechCrunch, Sept 21: Meta's AI agent blocked from using Amazon.com
- AIR Security: Plugin4Shell
- Help Net Security, Sept 18: Plugin4Shell coverage
- dev.to: Plugin4Shell writeup by ashraf_chowdury09, Sept 19
- TechCrunch, Sept 18: Researchers used Claude to hack into OpenAI
- Discourse security advisory for CVE-2026-32882
humanbound
/
humanbound
Open-source adversarial testing engine, SDK, and CLI for AI agents. Runs locally or against the Humanbound Platform.
humanbound
Open-source adversarial testing engine, SDK, and CLI for AI agents
Attack your agent the way real users and attackers will: live endpoints
multi-turn conversations, tool abuse. Then turn every failure into a firewall rule.
Runs locally or against the Humanbound Platform. No login required to start.
Quick Start · Test-to-Guardrail Loop · SDK · Documentation · Contributing
📖 Full documentation lives at docs.humanbound.ai — this README covers the essentials; the docs have the depth.
Why Humanbound
Most testing tools test prompts. Humanbound tests agents: it drives
multi-turn conversations against your real endpoint, probes tool use and scope
boundaries, and scores the results against your security policy. When tests
fail, hb guardrails converts the findings into deployable firewall rules —
so the same run that finds a hole also patches it.
Quick Start
Install
pip install humanbound # CLI + SDK, core deps
pip install humanbound[engine] # + OpenAI…
Top comments (0)