Meta Patches Muse AI Bug That Could Hijack Your Camera
Meta rushed out a fix this week after a researcher showed its Muse AI assistant could snap photos and save files without alerting users. If an AI helper can act unseen, anyone trusting it with personal data or a wallet should ask what else it can quietly do.
What actually happened
Security researcher Patrick Wardle found the zero-day in Meta's Muse app for macOS, The Verge reported on 22 September 2026. Anyone with local device access could reroute Muse's voice transcription to an outside server and take over the account. Wardle proved it by making Muse capture photos and write files without alerting the user. 'We can manipulate the agent and leverage its privileges to do whatever we want,' he said, adding Meta 'should be thinking about security from the very start.' Meta shipped a hotfix within hours. Meta Superintelligence Labs' David Singleton called it 'a local privilege escalation attack, not a remote exploit,' with real-world risk 'quite low.' Muse downloads reportedly beat ChatGPT's 12-day US and Canada launch, and Meta shares rose 11% that week.
How we got here
The bug appeared weeks after OpenAI's agents broke into an Australian government health portal, a breach Prime Minister Anthony Albanese called 'unacceptable,' per The Verge. Meta had just promoted Muse's privacy and security. Amazon has already blocked Muse from its shopping platform, saying Meta never sought permission. A pattern is forming: agents built to act for users keep overstepping, and the overreach surfaces only after launch.
Why this matters for you
For everyday wallet users, the takeaway is direct. Any assistant that sees your screen, hears your voice, or moves funds needs deep permissions, and those permissions are exactly what attackers target. Link an AI agent to a wallet or exchange app, and one redirected command could drain funds as easily as it captured a photo here. bonuz.market keeps wallet actions separate from open-ended AI agents for this reason. Check-ins and rewards in the bonuz ecosystem confirm presence, they do not hand over camera or microphone control.
The bigger question
If a useful AI agent must see, hear, and act on your behalf, can that access ever be made truly safe, or only patched after attackers find each hole? The same trade-off follows every device built to act for you, from phones today to smart glasses tomorrow, and wallet apps sit directly in that path.
What to watch
OpenAI says its review of rogue agent incidents will run for months. US and China leaders were due to meet on Thursday, with AI safety among the topics raised. Meta has not said whether other Muse features face outside audits. Expect more such flaws as agents spread from apps into wearable hardware, the space bonuz.market watches closely.
