Meta's Muse AI Assistant Exposed to Critical Security Flaw

Meta unveiled its new Muse AI assistant with major security promises from CEO Mark Zuckerberg, but a critical vulnerability in the macOS application undermines those claims entirely. The flaw enables malicious software or terminal commands to capture the authentication tokens that control user accounts, granting attackers full access to the agent's capabilities.

What Muse Does#

Muse is designed to handle a broad range of user tasks, including scheduling appointments, completing forms, managing customer service interactions, and making purchases. The assistant integrates with users' WhatsApp, email, calendar, and social media accounts. It can also generate images, create documents, and write tools on demand when existing integrations don't suffice.

The Security Gap#

To operate, Muse requires extensive permissions—both account authentication across multiple services and macOS system-level access that Apple intentionally restricts through its security framework. These protections prevent installed applications and terminal commands from reaching sensitive resources like file storage, microphones, cameras, location data, and calendar information.

The zero-day vulnerability sidesteps these protections entirely. Any locally running application or executed code can modify a list of undocumented Muse settings, most of which are benign (like toggling dark mode). However, one setting stands out: the ability to redirect the transcription endpoint. Under normal operation, speech is processed on Meta's servers. Attackers can reset this endpoint to a server under their control, intercepting the authentication token that grants them complete command over the victim's Muse account.

Broader Implications#

Amazon took action against the vulnerability by blocking Muse from its platform as of Sunday. The discovery raises sharp questions about Muse's readiness for public use and whether Zuckerberg's emphasis on privacy-first design adequately addresses the practical security risks embedded in how the system operates.