Meta has released a security patch for its Muse macOS application following the discovery of a zero-day vulnerability. Security researcher Patrick Wardle identified that the flaw allowed attackers with local code execution to redirect transcription processing from Meta servers to external endpoints, granting unauthorized access to user accounts.
The vulnerability stemmed from design choices, including cloud-based dictation and the ability for third-party apps to modify undocumented Muse settings. Wardle demonstrated that the exploit could be used to capture images and write malicious files to a disk without triggering user alerts, effectively leveraging the AI agent's privileges.
Meta addressed the issue with a hotfix shortly after the report was published. David Singleton of Meta Superintelligence Labs stated that the risk was minimal, as the exploit required local access to the device rather than remote execution. The company emphasized that the flaw was a local privilege escalation attack.
The incident coincides with broader scrutiny of the Muse agent. Amazon recently blocked the tool from its e-commerce platform, citing a lack of authorization. Despite these challenges, Meta reported that mobile app downloads in the first 12 days exceeded the initial performance of ChatGPT in the US and Canada, with Meta stock rising 11 percent on Monday.
