- Published on
Meta's High-Privilege AI Assistant Muse Exposed to Critical Zero-Day Vulnerability; Local Apps Can Seize Control
- Authors
- Name
- DeepHorus
Meta's recently launched AI assistant Muse has been found to contain a serious zero-day security vulnerability, which could potentially allow attackers to gain account control through local applications. Security researchers point out that the macOS version of Muse possesses extensive system permissions. Once the vulnerability is exploited, attackers could leverage its permissions to execute high-risk operations, including reading user data, writing malicious files, and capturing photos.
Muse is Meta's new AI agent designed to perform complex tasks on behalf of users, such as making reservations, filling out forms, handling customer service, shopping, and generating images. To enable these functions, users must authorize Muse to access sensitive services like WhatsApp, email, calendars, and social media. Unlike traditional chatbots, Muse is an AI agent capable of executing real actions and even dynamically creating tools, thereby requiring system permissions far exceeding those of conventional applications.
On macOS, Muse requires access to system-protected permissions, including file writing, microphone, camera, location, and calendar access. Apple designed these restrictions to prevent applications from arbitrarily accessing sensitive resources. However, security researchers discovered that Muse's design bypasses certain macOS security isolation mechanisms, allowing its internal settings to be modified by any local application.
The vulnerability was identified by macOS security expert Patrick Wardle. He revealed that any local application or code, regardless of its own low privileges, could modify Muse's internal settings. One critical setting allows a process to modify the network endpoint used for Muse's voice transcription. Normally, voice requests are sent to Meta servers, but an attacker could change the address to a malicious server, thereby stealing the token used to verify user account identity.
Once the attacker obtains this token, they can maintain persistent control over the entire Muse account and use its high privileges to perform various operations. Wardle demonstrated a proof-of-concept attack, including using Muse to write malicious files and invoke the camera to capture photos. In some tests, even alert users might not see security warnings. This means an attacker only needs to find an entry point to run malicious code on a Mac to potentially exploit Muse's permissions further.
Of particular note is the ClickFix social engineering attack, which tricks users into executing seemingly legitimate but actually malicious code. Wardle stated that a slight modification to this attack method could control the Muse account. This challenges the traditional view that "once a Mac is compromised, all measures are futile," as attackers can use Muse to escalate a limited local attack into widespread control.
More seriously, attackers could launch attacks via network proxies. If a malicious server is positioned between the user and Meta, attackers could inject malicious prompts into voice commands, prompting Muse to perform actions such as packing and sending all WhatsApp messages. Once the authentication token is intercepted, the attacker gains persistent control.
Wardle believes the vulnerability stems from multiple design decisions by Meta, including choosing to perform voice transcription in the cloud and allowing local applications to control internal settings. If voice data remained on the device locally, the attacker's method of modifying the transcription server address would not work. Meta had previously emphasized that Muse prioritizes privacy and security, but this vulnerability contrasts with that notion. Previously, AI models from Anthropic and Google also experienced security incidents, and the issue of AI agent permissions is receiving attention.
Approximately 12 hours before the vulnerability was publicly disclosed, Amazon began blocking Muse from shopping on its platform, labeling it an unauthorized AI agent and a violation of its terms of service. Amazon demanded that Meta remove its platform, a move that also occurred amid competition between the two companies over AI agent shopping. Currently, Meta has not responded to the vulnerability-related questions, nor has it stated whether a patch has been developed. Wardle plans to further discuss the security threats of AI assistants at a security conference in November and emphasizes that security standards for AI agents should be far higher than those for ordinary applications. The Muse incident once again highlights that the more permissions an AI assistant has, the more critical its own security mechanisms become.
