Meta’s Muse AI Assistant Rolled Out With a Serious Security Flaw
wired ·
Meta’s new AI assistant, Muse, was released with a critical zero-day vulnerability that allows local applications and terminal commands to gain complete control over user accounts. Security expert Patrick Wardle discovered that the flaw enabled attackers to manipulate authentication tokens by changing the endpoint for voice transcription from Meta’s servers to their own. This exploit effectively bypassed macOS security defenses, allowing malicious actors to execute tasks such as writing files or capturing photos without detection. Although Meta issued a hotfix approximately twelve hours after the vulnerability was disclosed, critics argue the design choices prioritized functionality over security. The incident has drawn sharp criticism from Amazon, which began blocking Muse due to concerns over unauthorized third-party access to its platform. Wardle highlighted that the ease of triggering this exploit via social engineering techniques like ClickFix undermines Meta's claims of robust privacy protections. Consequently, the release raises serious questions about the safety and reliability of AI agents granted extensive system permissions.
wired