Security researcher Patrick Wardle discovered a zero-day vulnerability in Meta's AI agent, Muse, for macOS. The flaw allows local applications to modify internal settings, including the network endpoint used for voice transcription. By redirecting these requests to a malicious server, attackers can intercept authentication tokens and gain persistent control over the user's Muse account.
Once an attacker gains control, they can leverage the AI's extensive system permissions to perform high-risk actions. These include writing malicious files to the disk, accessing the camera, or reading sensitive user data from integrated services like WhatsApp, email, and calendars. Wardle demonstrated that these actions can often be executed without triggering standard macOS security warnings.
The vulnerability stems from Muse's design, which bypasses certain macOS security isolation mechanisms and relies on cloud-based transcription rather than local processing. Wardle noted that the ability for any local process to modify sensitive configuration endpoints creates a significant security risk, as it allows attackers to escalate limited local access into full control over the AI agent.
In response to the broader implications of AI agents, Amazon has blocked Muse from making purchases on its platform. Amazon stated that Muse is an unauthorized agent that violates its terms of service, emphasizing that AI agents acting on behalf of customers must operate transparently. This move highlights the growing tension between AI developers and traditional e-commerce platforms.
Meta has not yet provided a response regarding the vulnerability, potential patches, or whether the flaw has been exploited in the wild. Wardle plans to present further details on the security risks posed by AI assistants at the Objective by the Sea conference in November, advocating for higher security standards for applications with broad system access.
