Meta patches zero-day in Muse macOS agent allowing account takeover via local access

According to The Verge, Meta issued a patch for a zero-day vulnerability in its Muse macOS app that allowed attackers with local device access to take control of user Muse accounts. The agent requires users to authenticate it to multiple services including WhatsApp, email, calendar, and social media, and grant macOS permissions for file writing, microphone, camera, and location access. Ars Technica reported the vulnerability raises questions about the agent's security posture given Meta founder Mark Zuckerberg's claims that Muse was "built from the ground up for privacy and security."