Muse for Mac Opens Local Files, Then Needs a Patch

Meta put Muse on the Mac on September 17, 2026, nine days after the agent’s US phone launch. The desktop build sits in the Dock and works inside files, Messages, Calendar, and Notes, with access the user turns on.

That grant is the product. Four days later a hidden dictation setting on the Mac client let other software on the same account ride those privileges, and Meta issued a hotfix on September 22. Amazon had already locked the agent out of its store on September 20.

A Dock Icon for Files, Messages, and Notes

Mark Zuckerberg wrote that Muse for Mac was out and that it works across apps, files, calendar, notes, and messages, with the user in control of access. “The team is shipping fast,” he added, and pointed people to Meta’s site to download Muse for macOS.

Muse for Mac is out today! It works across apps, files, calendar, notes, and messages on your computer. You control what it can access. The team is shipping fast. Download at https://t.co/BX3oX19Zcl

— Mark Zuckerberg (@finkd) September 17, 2026

Alexandr Wang, Meta’s chief AI officer, posted a matching note minutes later: the agent can get work done on the computer across files, messages, calendar, and notes, and it always asks before anything sensitive. He told people to add it to the Dock.

muse for mac is HERE!! your agent can now get stuff done right on your computer — files, messages, calendar, notes, all of it.

you're in control of what it can access, and it always asks before doing anything sensitive.

Add it to the dock – https://t.co/bFHgBZlkLj pic.twitter.com/mecGVDzXiq

— Alexandr Wang (@alexandr_wang) September 17, 2026

The Mac package is a direct install from Meta, not a Mac App Store listing. Meta’s download page says the agent organizes files, fills out forms, and pulls from Messages, Calendar, and Notes, all with permission. It also sells a cross-device loop: start a task on a phone, check it from a laptop, nudge it from WhatsApp, and keep the same thread through the day.

WHAT MUSE CAN TOUCH ON A MAC

• Local files: Organize folders, retrieve documents, and use file contents to finish forms.
• Messages, Calendar, and Notes: Pull context from Apple’s own apps and, with extra approval, take actions such as sending a message.
• Sensitive steps: Meta says the app asks before moves such as deleting a file or sending a message.
• Disk scope: Full Disk Access is optional, and permissions can be changed later in Settings.

A separate Meta AI app for Mac, shipped on August 19, 2026, can read a window the user hands it and reply. It does not drive files or apps. Muse is the acting product, and it is still US-only.

EARLY MOBILE NUMBERS BEHIND THE MAC SHIP

• Global installs: Apptopia counted 2.8 million Muse installs worldwide in the first 12 days after the September 8 phone and web debut.
• iOS cut: In the United States and Canada, Apptopia put iOS downloads at 1.8 million in that window, against 1.3 million for ChatGPT’s first 12 mobile days.
• Daily use: US daily users reached 642,000, against 231,000 for ChatGPT at the same stage of its own launch, per the same firm.
• Paid rungs: Muse is free with a usage cap, then $20 a month for Power and $100 for Maximum.

Those figures are third-party estimates, not Meta’s books, and they describe the phone apps. The Mac client is the new surface, and it is the one that has to live with Apple’s permission prompts.

The Agent Still Lives in Meta’s Cloud Box

The Mac window is a client. The agent Meta described on September 8 still runs in Muse Secure VM, a dedicated Linux virtual machine in Meta’s cloud with its own browser, storage, and CPU. Each person’s VM is isolated from every other user’s agent. Connectors for mail, calendars, and other services store credentials there, not in a shared Meta database.

A second process on that machine, Sentinel, is the only thing that can approve a connector action or let traffic leave the box. Muse proposes a step; Sentinel allows it, blocks it, or asks the person. Meta says the model never sees real passwords or card numbers. Surrogate tokens sit in the runtime cell, and the real secret is inserted at the network edge after Sentinel says yes.

No matter how strong the model is at the core, any agent like this will still make mistakes, and it will sometimes be attacked via the data it reads.

Tarek Sheasha, VP, Meta Superintelligence Labs, on how Meta built safety into Muse

Sheasha’s post walks through the rest of that design: a sandboxed runtime cell, a separate credential store, and a human-in-the-loop dialog that goes to the client UI rather than through the chat. Meta also opened a bug bounty of up to $300,000, including up to $130,000 for a prompt-injection hit on one user. The September 8 Muse launch note promised a stronger Confidential VM later in 2026, encrypted with a key only the user holds.

Read how Meta built safety into Muse and the cloud story is consistent. The Mac app is the part that story did not cover, because the September 8 clients were iOS, Android, and the web UI talking to the VM over a secure transport. The Dock icon arrived nine days later, with a new job: reach into the machine in front of the user.

A Four-Day-Old Client Became the Weak Door

On September 21, Patrick Wardle, founder of the Objective-See Foundation, told Mac users not to install Muse. In Wardle’s Muse Mac disclosure thread he said it was trivial to turn the assistant into a backdoor, and he published a proof of concept he named not-a-mused.

We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.

Patrick Wardle, founder, Objective-See Foundation

The flaw sat in an undocumented setting, endo_voyager_dictation_endpoint. Any process running as the same Mac user could change it, with no extra macOS permission. The next time someone tapped the microphone and dictated a prompt, the audio went to an attacker’s server instead of Meta’s. From there, Wardle said, an attacker could capture prompts, inject new ones, steal Muse’s sign-in material, and reuse whatever Files, Messages, Calendar, Notes, microphone, or camera access the user had already granted.

He also argued that Apple already offers on-device dictation to developers, and that sending voice to Meta’s servers for this feature widened the hole. Proof-of-concept runs he described included writing files to disk and taking pictures, often with no alert. He later added that a ClickFix-style paste in Terminal could be enough to plant the local code, which is how he framed a remote path to a bug Meta called local.

David Singleton of Meta Superintelligence Labs answered on September 22. He said the company had issued a hotfix, called the issue a local privilege escalation rather than a remote exploit, and said harm required malicious code already running under the user’s account, so “the practical risk to users of the Muse Mac app was therefore quite low.” He added that dictation uses a server-side speech model, that the redirect setting was an internal debug control stored in local preferences (which macOS lets any program under that account edit), and that the bug “does not involve Muse’s servers or the Secure VM that isolates agent tasks.” The hotfix, he wrote, removes the endpoint setting from production builds entirely.

Wardle posted “Hooray, hot-fixed!” the same day and still flagged the ClickFix route. The two statements can both be true: the setting lived on the Mac, and the cloud box Meta spent the launch explaining never saw it. Users who already installed the app need the new build. The Dock icon is still the same product, with the same reasons to grant it a lot, and a reminder that a debug leftover in a high-privilege client is enough to make the VM’s walls irrelevant.

Amazon Stops Muse at the Storefront

The other door slammed two days before Wardle posted. On the night of September 20, people who sent Muse to Amazon started seeing a popup: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”

An Amazon spokesperson said third-party apps that offer to buy from other businesses should operate openly and respect a service’s choice not to take part, and that agent apps such as Muse have the same obligations. Amazon said Meta did not tell it that Muse would hit the store, that the agent does not identify itself while browsing, and that it appears to capture customer credentials. The company also said Muse can reach account pages and order history if a person asks it to.

Meta’s own launch copy says Muse has no visibility into passwords or payment methods, checks out with Link by Stripe on a one-time card, and is the first agent covered by Link’s purchase protections. Shop Pay, Meta said, is coming. None of that binds Amazon. Muse’s cloud browser can shop only where the shop lets it, and Amazon chose not to.

The same week, Muse and a San Francisco rival, Instinct, both turned on outbound calls to businesses. Instinct is a text-thread agent with no required app. Muse is the mass-market app with WhatsApp and now a Mac client. Calling was the feature smaller agents had used as a wedge. Both shipped it, and the shopping fight moved to who owns the cart.

The Desktop Race Muse Did Not Start

Muse is not the first agent that can operate a Mac. Claude’s desktop app can already click, type, and open apps, and as of September 2 it can do that in the background on macOS 15 or later, in a separate window, while the user keeps working. ChatGPT’s Mac app has a Computer Use plugin that drives apps with the pointer. Apple Intelligence, on Apple silicon, still rewrites and summarizes in place; it does not take over the desktop.

FOUR WAYS TO PUT AN AGENT ON A MAC

Muse’s bet is structured access to Apple’s apps plus a phone habit that already exists, not a new trick with the mouse. That is a different architecture from screen-reading computer use, and it is also a different trust ask: the user is not letting a model look at pixels, they are letting Meta’s client into Messages. Apple’s TCC prompts become the real product surface. If those prompts stay scary, the Dock icon is a chat window with extra entitlements. If people click Allow, Muse inherits the same reach Wardle used as a stealer.

What Users Grant When They Pin Muse

Meta’s permission story has several switches, and they do not all default the same way. Connector access is opt-in. Send and delete stay behind an extra prompt unless the user widens that. Full Disk Access stays off unless someone turns it on. A separate account, kept out of Accounts Center, keeps Muse data from other Meta products. People can disconnect a connector, delete messages and VM files, reset the agent, or tell it to forget a topic.

SWITCHES THAT STAY ON UNLESS YOU FLIP THEM

• Training: The setting that lets Meta use Muse interactions to improve models is on at first use, including connector data used in a task; it can be turned off, and the change applies to past chats. Meta says it still strips names, emails, phone numbers, and Social Security numbers.
• Ads: Muse does not share conversations or VM data with Meta ad systems, even if Accounts Center is linked.
• Memories: Deleted files can still leave traces in what Muse “remembers” until the user runs Forget or inspects MEMORY.md.
• Wearables: Glasses are listed as coming, with a separate wearable privacy policy if Muse runs there.

The Muse privacy policy dated September 17 is the Mac-day document. It still describes the cloud VM as the core place Muse keeps what you share. It does not walk through macOS TCC, Screen Recording, or Accessibility. Those prompts belong to Apple, and they are what a user actually sees when the Dock icon asks to read Messages.

People who spent years angry at how much Meta already knew are now the same people who can hand it a calendar and a file tree because it will book a table. The opt-in screens make that a choice. They do not make it a small one. An agent with send rights on Messages is a more valuable process to hijack than a chatbot that only talks.

Wang’s Year-Old Plan Follows a Same-Week Patch

On September 22, the same day as the hotfix, Wang posted an excerpt from a note he wrote for Meta’s board in September 2025, and said he, Nat Friedman, and the team had been building Muse for a long time. Muse Spark, the model line behind the agent, shipped on April 8, 2026, as the first major model from Meta Superintelligence Labs after Wang joined as chief AI officer following about a $14 billion investment in Scale AI. The consumer app’s internal name, Hatch, still shows up in the safety write-up.

FROM SPARK TO A MAC HOTFIX

1. April 8, 2026: Meta Superintelligence Labs ships Muse Spark, the model line later used for the agent.
2. August 19, 2026: Meta AI for Mac ships as a read-the-window assistant that does not act on files.
3. September 8, 2026: Muse opens in the US on iOS, Android, muse.ai, and WhatsApp, with Secure VM and Sentinel as the launch argument.
4. September 16, 2026: Muse expands a beta for outbound calls to US businesses, the same day Instinct turns on calling.
5. September 17, 2026: Muse for Mac ships; the Muse privacy policy takes effect the same date.
6. September 20, 2026: Amazon begins blocking Muse from its store with the unauthorized-agent popup.
7. September 21, 2026: Wardle discloses the Mac dictation-endpoint bug and tells people not to install.
8. September 22, 2026: Meta hotfixes the Mac app and removes the debug setting from production builds.

The speed Zuckerberg advertised is real: a phone hit, a Mac client nine days later, a patch five days after that. The invoice is real too. The VM and Sentinel still wrap the agent in the cloud. The Mac app is the privileged remote control, and it shipped with a debug endpoint that any same-user process could point somewhere else. Amazon, meanwhile, showed that a merchant can refuse the cloud browser even when the user said yes.

Wardle said he will share more bugs at the Objective by the Sea conference. Singleton said the practical risk of this one was quite low, and the setting is gone from production. Anyone who installed Muse for Mac still needs the build from September 22, and anyone who left Full Disk Access or send rights on is trusting a client that is now one patch deep.