Meta Patches Zero-Day Vulnerability in Muse AI Agent App
Meta has released a patch to address a zero-day vulnerability discovered in its Muse macOS app, which could allow attackers with local access to take control of the AI agent. The exploit was identified by security researcher Patrick Wardle and allowed malicious actors to redirect transcription processing from Meta’s servers to their own endpoints. The flaw stemmed from design choices such as cloud-based dictation and unrestricted access to undocumented settings. Proof-of-concept attacks demonstrated that attackers could manipulate Muse's privileges, enabling unauthorized actions like taking photos or writing files without user alerts. Despite the patch being issued quickly after a report by Ars Technica, Wardle criticized Meta for not prioritizing security from the start. Meta emphasized that real-world risks were low since the exploit required local access to the device and was not remotely exploitable. The vulnerability comes amid increased scrutiny of Muse as it faces competition in AI services.
Tickers: $META
Topics: AI cybersecurity Meta Muse zero-day exploit