Patrick Wardle discloses Muse 0-day that lets local apps hijack Meta's AI assistant

Security researcher Patrick Wardle disclosed a zero-day in Meta's Muse AI assistant that lets any locally installed app or terminal command steal the authentication token and gain complete control of a user's Muse account, contradicting Mark Zuckerberg's claim that Muse is "built from the ground up for privacy and security." The flaw stems from an undocumented Muse setting that lets local processes redirect the transcription endpoint from Meta's server to an attacker-controlled address, bypassing macOS permissions; Amazon separately began blocking Muse from its site on Sunday. Meta introduced the macOS-only Muse a few weeks ago, and it connects to users' WhatsApp, email, calendar and social media accounts.

Meta founder and CEO Mark Zuckerberg has gone to great lengths https://x.com/finkd/status/2097402102477701478 to hype the security of its new AI assistant, Muse, claiming it is “built from the ground up for privacy and security.” A zero-day vulnerability that gives locally run apps and terminal commands complete control of the agent raises serious doubts. Further raising questions, Amazon on Sunday began blocking Muse from its site. Meta introduced https://ai.meta.com/muse/ Muse a few weeks ago. The assistant “books appointments, fills out forms and handles customer service,” “proactively takes tasks off your plate,” and can “make purchases, generate images, create documents, and connect with your favorite apps and services.” The macOS app curiously, there’s no Windows version also works with a user’s WhatsApp, email, calendar, and social media accounts. When a task requires a tool that doesn’t exist, Muse creates one on the fly. Meta doth hype Muse security too much Of course, for Muse to do any of these things, users must first give it access to their accounts. This includes authenticating the assistant to each service and, because the app runs on macOS, giving it permissions to a broad range of operating system-restricted device resources, like writing files to disk, accessing the mic and camera, and monitoring location and calendars. Apple has spent years developing these defenses to prevent installed apps or commands entered into the terminal from accessing these resources, clearly because the company considers them a security threat. Muse completely undoes these default measures. The zero-day https://x.com/patrickwardle/status/2102045926474785265?s=20 allows any app or terminal command to gain access to the token that authenticates users to their Muse account. Meta developers designed the assistant so that any locally installed app or executed code, regardless of the macOS permissions it has, can change a long list of undocumented settings. Most of them are fairly innocuous, such as controlling dark mode. One setting, however, is anything but innocuous. It allows processes to change the endpoint where transcription occurs. Normally, it’s a server address operated by Meta. Attackers can exploit this flaw by changing the location to their own endpoint. Once that happens, the attackers have the token that gives complete control over the Muse account.