Meta has released a patch for its Muse macOS application following the identification of a zero-day vulnerability that could potentially allow unauthorized users to take control of the AI agent. This flaw was discovered by security researcher Patrick Wardle, who noted that it exploited an undocumented setting within Muse, enabling attackers to redirect transcription processing from Meta’s servers to their own systems, as reported by The Verge.
The vulnerability stemmed from several design choices, including the decision to process Muse dictation in the cloud rather than on the device itself. Additionally, the app allowed any application to manipulate all of Muse’s undocumented settings. Wardle demonstrated proof-of-concept attacks that enabled him to take pictures and write malicious files to disk without alerting the user in many instances.
Wardle expressed concerns about the security measures in place, suggesting that the design of Muse could allow attackers to leverage the AI assistant’s privileges for malicious purposes. He indicated that instead of developing complex malware, attackers could simply exploit the AI assistant itself. This criticism contrasts sharply with Meta’s earlier emphasis on Muse’s privacy and security features during its announcement.
In response to the vulnerability, Meta acted swiftly, issuing a patch shortly after the report was published. The company maintains that the real-world security risks were minimal, as the exploit required local access to the user’s device. David Singleton from Meta Superintelligence Labs clarified that this was a local privilege escalation attack, meaning that it necessitated malicious code already running on the user’s machine, thus limiting the practical risk to users of the Muse Mac app.
Despite the rapid resolution of the issue, the exploit has emerged at a challenging time for Meta, as the company seeks to regain its competitive edge in the AI sector. Recently, Amazon blocked Muse from accessing its e-commerce platform, claiming that Meta had not secured permission to do so. Nevertheless, the launch of Muse has seen significant success, with estimated downloads of the mobile app reportedly surpassing those of ChatGPT during its initial 12 days in the US and Canada. Following the launch, Meta’s stock experienced an 11 percent increase.
Follow our Tech news coverage for related developments.
