Published 13 hours ago • loading... • Updated 2 hours ago

Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

On Sunday, Amazon began blocking Meta's new AI assistant, Muse, after security researcher Patrick Wardle discovered a zero-day vulnerability allowing local apps to gain broad access to user data and authentication tokens.
CEO Mark Zuckerberg previously claimed Muse was "built from the ground up for privacy and security," yet the assistant integrates with WhatsApp and calendars, undermining Apple's Transparency, Consent, and Control framework.
By modifying an undocumented setting, attackers can redirect dictation traffic to their own endpoint, stealing authentication tokens and gaining complete control over a user's Muse account and connected services.
Objective-See founder Patrick Wardle likened the vulnerability to a "bad neighbor," stating, "I think some of their greediness for user data kind of opens the door, makes a bigger attack surface."
These companies are "racing for what's next," said Wardle, often neglecting security priorities, while Meta did not immediately respond to requests for comment regarding the privilege escalation vulnerability.

Insights by Ground AI

10 Articles

Ars Technica

Center

Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

A simple ClickFix attack is only one way to completely hijack the new agent.

12 hours ago·Cambridge, United States

Read Full Article

The Register

Center

Meta Muse AI app flaw lets local malware redirect dictation traffic

Ad biz promises users control while bug could expose voice prompts

14 hours ago·London, United Kingdom

Read Full Article

Bitnewsbot

Mac Malware Hijacks Meta Muse, Security Researcher Warns

A Mac security researcher demonstrated that malware already running on a system can quietly hijack Meta's newly launched Muse AI assistant and weaponize the

2 hours ago

Read Full Article

Punto Informatico

Vulnerability 0-Day Transforms Meta Muse Into a Backdoor

A zero-day vulnerability of the Muse app for macOS allowed you to take advantage of an undocumented setting to access the user's account.

3 hours ago

Read Full Article

IT Security News - cybersecurity, infosecurity news

Meta’s Muse AI Agent 0-Day Vulnerability Allows Attackers to Hijack the Tool and Inject Malware

A zero-day vulnerability in Meta’s Muse AI agent for macOS could allow malware already running under a user account to hijack the assistant, intercept… Read more →

6 hours ago

Read Full Article