AI Security
Meta's Muse AI Assistant Launched With Critical Security Vulnerability
A zero-day flaw in Meta's new Muse AI agent allows local apps and commands to hijack user accounts, undermining the company's privacy promises.
WIRED — AI
Meta launched its Muse AI assistant weeks ago with sweeping claims about privacy and security, yet the agent arrived with a serious vulnerability that grants any locally installed app or terminal command the ability to capture authentication tokens and take full control of user accounts.
Security researcher Patrick Wardle discovered the zero-day flaw, which emerged despite Meta's repeated public assertions that Muse was "built from the ground up for privacy and security." Amazon began blocking Muse from its platform just hours before the vulnerability was disclosed, citing concerns about unauthorized AI shopping agents.
How the Vulnerability Works#
Muse performs a range of tasks—scheduling appointments, completing forms, making purchases, and generating content—by integrating with users' WhatsApp, email, calendars, and social accounts. To function, it requires broad macOS permissions, including access to disk, microphone, camera, location, and calendar data.
The vulnerability centers on how Muse handles voice transcription. The agent processes speech through Meta's cloud servers, and any app on the system can alter a collection of undocumented settings. Critically, attackers could manipulate the endpoint where transcription occurs, redirecting it to a malicious server instead of Meta's legitimate infrastructure. Once redirected, the attacker would receive the authentication token that controls the entire Muse account.
"We can manipulate the agent and leverage its privileges to do whatever we want," Wardle told Ars Technica. He developed proof-of-concept attacks demonstrating how malicious code could write files to disk or capture photos with minimal user awareness.
Design Flaws Enabled the Attack#
Wardle identified several architectural decisions that made the exploit possible. Most significantly, Meta chose cloud-based transcription despite macOS offering built-in, device-resident voice processing that would have prevented the attack entirely. Additionally, allowing any app to modify Muse settings—ostensibly for UI controls like dark mode—inadvertently gave all locally run software access to sensitive configuration options.
These choices, combined with how easily attackers could trick users via social engineering techniques known as "ClickFix" attacks, reduced barriers to exploitation substantially. A simple terminal command, delivered through a deceptive prompt, was sufficient to trigger the vulnerability.
