Patrick Wardle is a macOS security researcher, the founder and co-director of the non-profit Objective-See Foundation, and the author of The Art of Mac Malware book series (Source: objective-see.org). On September 21, 2026 he disclosed a zero-day vulnerability in the macOS application of Meta's Muse AI agent that allowed locally run code to take control of a user's Muse account (Source: arstechnica.com).
| Field | macOS security research |
| Organizations | Objective-See Foundation (founder, co-director); DoubleYou (CEO, co-founder) |
| Previously | NASA; National Security Agency |
Background
Objective-See describes Wardle as a security researcher and the creator of its macOS security tools (Source: objective-see.org). DoubleYou, which he co-founded with Mikhail Sosonkin, lists him as its chief executive and states that he has worked at NASA and the NSA and that his work consists of "discovering Apple 0days, studying macOS malware, and releasing free open-source security tools to protect Mac users" (Source: double-you.io). Ars Technica describes him as co-founder of the Objective-See Foundation and a former employee of NASA and the National Security Agency (Source: arstechnica.com).
Muse zero-day disclosure
Meta launched Muse, a personal AI agent with access to a user's email, calendar and payment accounts, in September 2026 and expanded it to the Mac on September 17 (Meta AI). Wardle's disclosure, reported by Ars Technica on September 21, described a design in which any locally installed application or terminal command, regardless of its macOS permissions, could change a long list of undocumented Muse settings. One setting controls the endpoint used for cloud voice transcription; redirecting it to an attacker's server hands the attacker the token that controls the user's Muse account. Wardle told Ars Technica: "We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." He said he had built several proof-of-concept attacks, including writing malicious files to disk and taking pictures, in many cases without visible indication to the user, and that a variant of the "ClickFix" social-engineering technique, in which a user is induced to paste a command into the terminal, was sufficient to trigger the attack (Source: arstechnica.com).
Wardle attributed the flaw to two design choices: performing dictation in the cloud rather than with macOS's on-device facility, and allowing any application to control all of the undocumented settings. He said: "To me, the bar is infinitely higher in terms of the security of these apps. They don't have to be perfect, but when you take a look at Muse, it's like they didn't, in my opinion, think about security, which is really worrisome." He said he planned to discuss the vulnerability and other AI-assistant threats at Objective by the Sea in November 2026 (Source: arstechnica.com). Wardle released a proof-of-concept tool and wrote that "serious 0-day flaw(s) can let local malware/attackers invisibly hijack it" (Source: tech-insider.org).
Ars Technica updated its report to say that more than 12 hours after publication Meta stated it had released a hotfix that patched the zero-day; Meta described the flaw as "not a remote exploit" (Source: arstechnica.com). The Verge reported on September 22 that Meta had issued a patch for its Muse macOS app following the discovery of the vulnerability Wardle found (Source: theverge.com).
Relationships
- related: Meta AI — disclosed the Muse macOS zero-day
- related: Agentic AI — security of privileged AI agents
- related: AI and Cybersecurity
- related: National Security Agency (NSA) — former employer