Meta recently launched Muse, an AI assistant for macOS that manages tasks like scheduling, document creation, and purchasing. The application requires extensive system permissions, including access to files, the microphone, camera, and location data, effectively bypassing standard macOS security protections.
Security researcher Patrick Wardle discovered a zero-day vulnerability that allows any locally installed application or terminal command to hijack a user's Muse account. By exploiting undocumented settings, an attacker can redirect the transcription endpoint from Meta's servers to their own, gaining full control over the assistant's privileges.
Wardle demonstrated that this flaw enables attackers to execute malicious actions, such as stealing data from WhatsApp or capturing images, often without alerting the user. He noted that the vulnerability stems from design choices, such as processing dictation in the cloud rather than locally on the device.
Amazon has officially blocked Muse from its platform, citing that the assistant violates its terms of use. The company stated that third-party agents must operate transparently and respect service provider policies, requesting that Meta remove Amazon integration from the assistant.
Wardle, a former NSA employee and founder of the Objective-See Foundation, plans to present further details on these AI assistant threats at the Objective by the Sea conference in November. He criticized Meta's security approach, arguing that the assistant lacks fundamental protections for its high-privilege access.
