Muse security: VM-access bug downgraded SEV-2 to SEV-3, macOS dictation hijack hotfixed
A report citing The Information details two September security flaws in Meta's Muse agent: a bug-bounty flaw that could expose a user's Muse Secure VM, initially rated SEV-2 then downgraded to SEV-3, and a macOS dictation hijack found by Patrick Wardle that redirected voice traffic and stole auth tokens, hotfixed within a day. Meta frames both as local privilege escalation with low real-world risk; Wardle argues an agent authorized to spend money and control devices is a far bigger target than ordinary malware.