Muse Exposes Zero-Day Vulnerability, Local Programs Can Hijack Agent Permissions

Beating AI News Flash: Meta's personal AI Agent Muse had only been live for two weeks when security researcher Patrick Wardle uncovered a local zero-day vulnerability.

As long as an attacker can get a piece of code to run on a Mac under the current user's identity, they can modify a hidden setting in Muse and redirect voice requests to their own server. This code does not require additional macOS privileges. After that, they can intercept what the user says to Muse, inject malicious instructions, and potentially obtain Muse's authentication credentials.

Muse itself can access system resources such as files and the camera. Whatever permissions the user has granted to Muse, malicious programs may be able to use Muse to invoke those permissions. However, this is not a vulnerability that can remotely compromise a Mac; an attacker must first get code running locally on the machine.

When Meta released Muse, it specifically emphasized its security design and added Muse Secure VM and an independent Sentinel Agent. Unexpectedly, the first zero-day vulnerability turned out to be in a hidden setting on the Mac client that any ordinary local process could modify.