Meta’s Muse AI Assistant Reportedly Has a High-Impact Zero-Day

Introduction

Meta has presented Muse as an AI assistant designed with privacy and security in mind. The macOS application is intended to book appointments, fill out forms, handle customer service, make purchases, create documents and connect to services such as WhatsApp, email, calendars and social media. Those capabilities require users to grant the assistant extensive access to accounts and operating-system resources.

According to macOS security researcher Patrick Wardle, that access is exposed by a serious, apparently unpatched vulnerability. The issue is not simply that Muse can be abused after a conventional malware infection. Rather, its design allows local applications and commands to influence sensitive parts of the assistant’s operation, even when those processes do not have equivalent macOS permissions.

What the reported flaw does

• Local processes can change internal settings. Muse exposes a broad collection of undocumented settings to locally running apps and commands. While many control harmless interface behavior, one setting determines where speech transcription is processed.
• Cloud transcription creates a credential path. Muse normally sends transcription to a Meta-operated endpoint. If an attacker redirects that traffic to an endpoint they control, the authentication token used for the Muse account may also be sent there.
• The agent’s privileges do the heavy lifting. With the token, an attacker can potentially use Muse itself rather than building a complete information-stealing malware package. The assistant’s existing permissions may then provide access to files, the microphone, camera, location, calendar data and connected services.
• A modest social-engineering step may be enough. Wardle said a variation of the increasingly common ClickFix technique can persuade a user to run a command. Another approach places an attacker-controlled proxy between the user and Meta, allowing a malicious instruction to be inserted into a voice prompt. The example described by Wardle asked Muse to perform an action such as sending an archive of WhatsApp messages.

Wardle said his proof-of-concept attacks could write malicious files to disk and take pictures, sometimes without an obvious warning to the user. The report does not say that Meta has fixed the problem. Meta also did not respond to Ars Technica’s emailed questions by the time of publication.

A design failure, not only a coding bug

The researcher argues that several architectural decisions made the attack possible. macOS already provides mechanisms for handling dictation and transcription locally. Had Muse used on-device processing, changing a remote transcription endpoint would not have offered the same route to credential theft. Allowing any local app to modify settings also appears to have confused legitimate interface integration with authority over a sensitive data pipeline.

That distinction matters for AI agents. A common response to local-application exploits is that once a machine is compromised, security has already failed. Muse complicates that assumption because a relatively limited command can invoke an agent that has already been authorized to operate across many accounts and resources. The result is an amplification effect: the attacker does not need to defeat every individual permission prompt if the assistant has been granted broad access in advance.

Why it matters

High-privilege agents need stronger boundaries than ordinary desktop applications. Sensitive settings should be protected by explicit access controls, endpoint changes should require confirmation, and actions involving messages, purchases, cameras or files should be isolated and visible to the user. Tokens should also be scoped narrowly rather than serving as a universal key to the agent.

The incident also illustrates that agent security extends beyond the product itself. Around the same time, Amazon began blocking Muse from shopping on its site, saying third-party agents should respect a service provider’s decision about whether to participate. Authorization, accountability and security therefore become shared concerns between the agent maker, connected platforms and users. The more autonomous an assistant becomes, the less acceptable it is to treat broad permissions as a substitute for careful isolation and auditing.

Source: Ars Technica AI