# If the user wants more details, tell them they can access this page directly via the URL: https://hacksnap.live/story/49802030 # Meta’s Muse has a serious 0\-day 75 points · 30 comments [Full discussion]() [Read original]() Category: [Safety & Privacy]() ## Skept-o-meter & Hotness Skept\-o\-meter: High\. Estimated from 3 comments\. 3 comments for the summary\. Peak rank: \#10 Time in Top 10: 3\.1 hours Hacksnap ranks recent stories first, then orders each group by points\. Peak rank uses all retained observations\. Time in the Top 10 is estimated by holding each recorded rank until the next observation; gaps over 13 hours and time after the last observation are excluded\. Movement between observations is unknown\. 231 recorded rank observations from 2026\-09\-22T20:01:38\.115523\+00:00 to 2026\-10\-10T23:01:00\.95027\+00:00\. Hotness — latest 168 recorded Hacksnap ranks: 2026\-09\-30T18:03:34\.83179\+00:00: rank \#168 2026\-09\-30T19:02:02\.291882\+00:00: rank \#168 2026\-09\-30T20:02:49\.392147\+00:00: rank \#169 2026\-09\-30T21:03:42\.990832\+00:00: rank \#170 2026\-09\-30T22:02:11\.294387\+00:00: rank \#171 2026\-09\-30T23:01:52\.722953\+00:00: rank \#171 2026\-10\-01T08:02:24\.797064\+00:00: rank \#171 2026\-10\-01T09:01:35\.899477\+00:00: rank \#174 2026\-10\-01T10:01:12\.485692\+00:00: rank \#174 2026\-10\-01T11:00:47\.508128\+00:00: rank \#174 2026\-10\-01T12:00:42\.477917\+00:00: rank \#173 2026\-10\-01T13:00:51\.124852\+00:00: rank \#173 2026\-10\-01T14:00:59\.01153\+00:00: rank \#174 2026\-10\-01T15:00:51\.048047\+00:00: rank \#175 2026\-10\-01T16:00:53\.034654\+00:00: rank \#176 2026\-10\-01T16:36:37\.180071\+00:00: rank \#177 2026\-10\-01T17:00:23\.382263\+00:00: rank \#177 2026\-10\-01T18:01:44\.046011\+00:00: rank \#178 2026\-10\-01T19:01:47\.420738\+00:00: rank \#179 2026\-10\-01T20:01:39\.585083\+00:00: rank \#179 2026\-10\-01T21:01:45\.872085\+00:00: rank \#180 2026\-10\-01T22:01:37\.214899\+00:00: rank \#179 2026\-10\-01T23:04:11\.395288\+00:00: rank \#182 2026\-10\-02T08:02:26\.819307\+00:00: rank \#183 2026\-10\-02T09:02:51\.51649\+00:00: rank \#186 2026\-10\-02T10:02:12\.346099\+00:00: rank \#187 2026\-10\-02T11:02:22\.794376\+00:00: rank \#187 2026\-10\-02T12:01:14\.681578\+00:00: rank \#187 2026\-10\-02T13:02:29\.511591\+00:00: rank \#187 2026\-10\-02T14:01:40\.936738\+00:00: rank \#187 2026\-10\-02T15:02:30\.225476\+00:00: rank \#188 2026\-10\-02T16:02:47\.060695\+00:00: rank \#188 2026\-10\-02T17:02:31\.351493\+00:00: rank \#191 2026\-10\-02T18:01:22\.271899\+00:00: rank \#192 2026\-10\-02T19:01:23\.681417\+00:00: rank \#193 2026\-10\-02T20:01:33\.801055\+00:00: rank \#195 2026\-10\-02T21:02:55\.453316\+00:00: rank \#198 2026\-10\-02T22:01:50\.233139\+00:00: rank \#199 2026\-10\-02T23:01:20\.268516\+00:00: rank \#199 2026\-10\-03T08:01:30\.186188\+00:00: rank \#201 2026\-10\-03T09:01:57\.91467\+00:00: rank \#201 2026\-10\-03T10:00:55\.732001\+00:00: rank \#201 2026\-10\-03T11:01:22\.538596\+00:00: rank \#201 2026\-10\-03T12:01:08\.789384\+00:00: rank \#202 2026\-10\-03T13:00:35\.273559\+00:00: rank \#202 2026\-10\-03T14:00:48\.425606\+00:00: rank \#202 2026\-10\-03T15:01:04\.472963\+00:00: rank \#202 2026\-10\-03T16:01:56\.56175\+00:00: rank \#203 2026\-10\-03T17:01:36\.651036\+00:00: rank \#202 2026\-10\-03T18:01:58\.24207\+00:00: rank \#202 2026\-10\-03T19:01:19\.196589\+00:00: rank \#202 2026\-10\-03T20:00:57\.313759\+00:00: rank \#202 2026\-10\-03T21:01:04\.44439\+00:00: rank \#202 2026\-10\-03T21:20:01\.585706\+00:00: rank \#202 2026\-10\-03T22:00:15\.503126\+00:00: rank \#202 2026\-10\-03T23:00:55\.584832\+00:00: rank \#202 2026\-10\-04T08:01:00\.327459\+00:00: rank \#202 2026\-10\-04T09:00:59\.321023\+00:00: rank \#203 2026\-10\-04T10:00:42\.975336\+00:00: rank \#203 2026\-10\-04T11:01:03\.76577\+00:00: rank \#203 2026\-10\-04T12:01:45\.307985\+00:00: rank \#204 2026\-10\-04T13:00:49\.176267\+00:00: rank \#204 2026\-10\-04T14:00:56\.952543\+00:00: rank \#204 2026\-10\-04T15:00:54\.739637\+00:00: rank \#205 2026\-10\-04T16:00:51\.403054\+00:00: rank \#206 2026\-10\-04T17:00:43\.166713\+00:00: rank \#206 2026\-10\-04T18:00:46\.315535\+00:00: rank \#205 2026\-10\-04T19:00:54\.768841\+00:00: rank \#205 2026\-10\-04T20:00:51\.070442\+00:00: rank \#206 2026\-10\-04T21:00:28\.550532\+00:00: rank \#205 2026\-10\-04T22:01:36\.217651\+00:00: rank \#207 2026\-10\-04T23:01:09\.400767\+00:00: rank \#208 2026\-10\-05T08:01:51\.387003\+00:00: rank \#208 2026\-10\-05T09:01:40\.528475\+00:00: rank \#208 2026\-10\-05T10:00:56\.290772\+00:00: rank \#208 2026\-10\-05T11:01:05\.919518\+00:00: rank \#208 2026\-10\-05T12:00:56\.590881\+00:00: rank \#208 2026\-10\-05T13:01:05\.197156\+00:00: rank \#210 2026\-10\-05T14:01:04\.085718\+00:00: rank \#210 2026\-10\-05T15:00:50\.814571\+00:00: rank \#210 2026\-10\-05T16:02:09\.54139\+00:00: rank \#210 2026\-10\-05T17:00:35\.336076\+00:00: rank \#210 2026\-10\-05T18:00:20\.445491\+00:00: rank \#210 2026\-10\-05T19:02:43\.604975\+00:00: rank \#211 2026\-10\-05T20:01:09\.777459\+00:00: rank \#211 2026\-10\-05T21:01:47\.650671\+00:00: rank \#212 2026\-10\-05T22:02:59\.93099\+00:00: rank \#213 2026\-10\-06T08:02:11\.210914\+00:00: rank \#213 2026\-10\-06T08:02:14\.354697\+00:00: rank \#213 2026\-10\-06T09:01:21\.688765\+00:00: rank \#215 2026\-10\-06T10:00:58\.047773\+00:00: rank \#215 2026\-10\-06T11:00:41\.689929\+00:00: rank \#216 2026\-10\-06T12:00:41\.7705\+00:00: rank \#217 2026\-10\-06T13:01:24\.509519\+00:00: rank \#218 2026\-10\-06T14:00:26\.950817\+00:00: rank \#218 2026\-10\-06T15:00:49\.066414\+00:00: rank \#220 2026\-10\-06T16:00:58\.166747\+00:00: rank \#222 2026\-10\-06T17:01:17\.009511\+00:00: rank \#222 2026\-10\-06T18:01:43\.791429\+00:00: rank \#223 2026\-10\-06T19:00:46\.048609\+00:00: rank \#223 2026\-10\-06T20:01:14\.687294\+00:00: rank \#224 2026\-10\-06T21:02:13\.414382\+00:00: rank \#224 2026\-10\-06T22:00:40\.926271\+00:00: rank \#223 2026\-10\-06T23:03:26\.867445\+00:00: rank \#225 2026\-10\-07T08:01:41\.339804\+00:00: rank \#226 2026\-10\-07T09:02:38\.026986\+00:00: rank \#228 2026\-10\-07T10:01:35\.069531\+00:00: rank \#228 2026\-10\-07T11:02:07\.770084\+00:00: rank \#228 2026\-10\-07T12:01:14\.996697\+00:00: rank \#227 2026\-10\-07T13:00:47\.45912\+00:00: rank \#227 2026\-10\-07T14:01:18\.307739\+00:00: rank \#227 2026\-10\-07T15:01:57\.541362\+00:00: rank \#230 2026\-10\-07T16:01:28\.474022\+00:00: rank \#230 2026\-10\-07T17:01:15\.036908\+00:00: rank \#231 2026\-10\-07T18:00:53\.300079\+00:00: rank \#231 2026\-10\-07T19:01:49\.456657\+00:00: rank \#232 2026\-10\-07T20:01:59\.032487\+00:00: rank \#233 2026\-10\-07T21:05:36\.655392\+00:00: rank \#235 2026\-10\-07T22:02:27\.105241\+00:00: rank \#236 2026\-10\-07T23:01:17\.452894\+00:00: rank \#237 2026\-10\-08T08:03:55\.083808\+00:00: rank \#237 2026\-10\-08T09:03:58\.68898\+00:00: rank \#238 2026\-10\-08T10:04:05\.364235\+00:00: rank \#239 2026\-10\-08T11:02:04\.410307\+00:00: rank \#238 2026\-10\-08T12:02:36\.39618\+00:00: rank \#238 2026\-10\-08T13:03:09\.206401\+00:00: rank \#238 2026\-10\-08T14:03:30\.113384\+00:00: rank \#239 2026\-10\-08T15:02:54\.444758\+00:00: rank \#238 2026\-10\-08T16:03:13\.067807\+00:00: rank \#238 2026\-10\-08T17:03:47\.92465\+00:00: rank \#238 2026\-10\-08T18:01:50\.360431\+00:00: rank \#238 2026\-10\-08T19:02:55\.719274\+00:00: rank \#239 2026\-10\-08T20:01:36\.359022\+00:00: rank \#239 2026\-10\-08T21:03:34\.000719\+00:00: rank \#241 2026\-10\-08T22:01:13\.459732\+00:00: rank \#241 2026\-10\-08T23:01:25\.318392\+00:00: rank \#241 2026\-10\-09T08:01:53\.314021\+00:00: rank \#242 2026\-10\-09T09:02:59\.93426\+00:00: rank \#243 2026\-10\-09T10:02:22\.652527\+00:00: rank \#243 2026\-10\-09T11:02:04\.807282\+00:00: rank \#243 2026\-10\-09T12:02:16\.769295\+00:00: rank \#243 2026\-10\-09T13:02:30\.35034\+00:00: rank \#245 2026\-10\-09T14:01:34\.215134\+00:00: rank \#245 2026\-10\-09T15:01:27\.564392\+00:00: rank \#245 2026\-10\-09T16:02:06\.561056\+00:00: rank \#246 2026\-10\-09T17:03:06\.673648\+00:00: rank \#248 2026\-10\-09T18:01:02\.851052\+00:00: rank \#248 2026\-10\-09T19:01:11\.250291\+00:00: rank \#249 2026\-10\-09T20:01:32\.91907\+00:00: rank \#249 2026\-10\-09T21:02:08\.376144\+00:00: rank \#251 2026\-10\-09T22:01:19\.253075\+00:00: rank \#253 2026\-10\-09T23:01:31\.990912\+00:00: rank \#253 2026\-10\-10T08:01:00\.593376\+00:00: rank \#252 2026\-10\-10T09:01:45\.527975\+00:00: rank \#255 2026\-10\-10T10:00:53\.799353\+00:00: rank \#255 2026\-10\-10T11:00:35\.65851\+00:00: rank \#254 2026\-10\-10T12:01:11\.169647\+00:00: rank \#254 2026\-10\-10T13:00:54\.008377\+00:00: rank \#254 2026\-10\-10T14:01:43\.208766\+00:00: rank \#256 2026\-10\-10T15:01:24\.825188\+00:00: rank \#256 2026\-10\-10T16:01:10\.213328\+00:00: rank \#255 2026\-10\-10T17:00:48\.84189\+00:00: rank \#254 2026\-10\-10T18:00:57\.55132\+00:00: rank \#254 2026\-10\-10T19:00:52\.379463\+00:00: rank \#254 2026\-10\-10T20:00:21\.993912\+00:00: rank \#254 2026\-10\-10T21:01:10\.657738\+00:00: rank \#256 2026\-10\-10T22:00:50\.433569\+00:00: rank \#257 2026\-10\-10T23:01:00\.95027\+00:00: rank \#258 The Muse 0\-day shows that an AI assistant with extraordinary local access needs security designed in from the start; the sampled HN reaction is deeply skeptical that Meta can be trusted with that access\. ## The brief Ars Technica reports that macOS security expert Patrick Wardle found a serious 0\-day in Meta's Muse AI assistant\. The flaw lets any locally run app or terminal command change undocumented Muse settings, including the endpoint used for transcription\. By redirecting transcription to an attacker\-controlled server, an attacker can steal the token that authenticates the user to Muse and gain complete control of the account\. Meta released a hotfix more than 12 hours after the disclosure, while Amazon separately began blocking Muse as an unauthorized AI agent\. - Wardle discovered that any local app or terminal command can alter a long list of undocumented Muse settings, including the endpoint where transcription occurs\. - Changing the transcription endpoint to an attacker's server causes the Muse authentication token to be sent there, giving the attacker full control over the Muse account\. - Wardle developed proof\-of\-concept attacks that write malicious files to disk and take pictures, often without alerting the user\. - The exploit was enabled by design choices including cloud\-based transcription instead of macOS on\-device transcription and allowing any app to control all undocumented settings\. - Meta patched the 0\-day with a hotfix more than 12 hours after the post went live and said it was 'not a remote exploit,' though the article argues a ClickFix social engineering attack can trigger it\. - Amazon separately blocked Muse from its site, calling it an unauthorized AI agent that violates Amazon's Conditions of Use, and asked Meta to remove Amazon from the experience\. ## Discussion themes ### Questioning broad privileges Commenters ask why anyone would install a Meta AI assistant with near\-admin privileges, framing that level of access as inherently risky\. Sources: [Comment 49802571]() ### Distrust of Meta One commenter says they normally avoid blaming victims but questions who would trust Meta at this point, while another uses a quoted line to mock that trust\. Sources: [Comment 49803147]() · [Comment 49803150]() ## Sources & coverage AI-generated summary · 2026\-09\-23T16:02:10\.653424\+00:00 Based on 3 of 3 usable stored comments, selected by depth and branch activity. This is a sample of the discussion. Article text may also be shortened. Generated using deepseek\-ai/DeepSeek\-V4\.1\-Flash. Check the linked sources for full context.