Security Claims Under Scrutiny

Meta founder and CEO Mark Zuckerberg has gone to great lengths to emphasize the security and privacy foundations of Muse, a recently introduced AI assistant designed to handle diverse tasks from scheduling appointments to making purchases. Despite these claims, a newly discovered zero-day has exposed the assistant to potential hijacking by locally run applications or terminal commands.

The Mechanism of the Exploit

The vulnerability centers on how Muse handles sensitive system settings. MacOS has historically implemented rigorous security controls to restrict applications from accessing protected resources like disk storage, cameras, and microphones. However, the architecture of the Muse application circumvents these defenses. According to macOS security expert Patrick Wardle, the software allows any local process to modify undocumented settings, including the endpoint responsible for voice transcription.

By changing this transcription server address to an attacker-controlled endpoint, a malicious actor can gain access to the authentication token that governs the user’s Muse account. Once this token is compromised, the attacker gains complete control over the assistant, enabling them to perform actions such as reading private WhatsApp messages or writing malicious files to the user’s disk without triggering alerts.

Design Decisions and Criticisms

The security failure has sparked significant debate regarding the design philosophy employed by Meta’s development team. Wardle specifically pointed to the decision to route dictation through cloud-based servers rather than utilizing secure, on-device processing—a capability that macOS has supported for years. Meta has attempted to address these concerns by publishing two posts in recent weeks aimed at detailing the security and privacy measures integrated into the assistant.

These communications arrive during a broader industry conversation regarding AI safety, following reports of security breaches involving models from companies like Anthropic and Google. Wardle argues that the bar for AI security must be significantly higher, noting that the ease with which Muse can be compromised suggests a lack of sufficient security-first architecture during its development.

Amazon Blocks Muse Access

Beyond technical vulnerabilities, the assistant is facing external pressure. Amazon has implemented a ban on Muse, preventing the AI from conducting shopping activities on its platform. In a formal statement, Amazon characterized Muse as an unauthorized agent that violates its Conditions of Use, arguing that third-party applications must operate transparently and respect the service provider's participation guidelines.

Future Outlook and Research

The exploit does not require advanced technical skill, with Wardle demonstrating that a remarkably effective version of a ClickFix attack is sufficient to gain unauthorized control. As researchers continue to analyze the assistant, experts are looking toward upcoming industry events for further disclosures. Wardle plans to discuss the technical specifics of this vulnerability at the Objective by the Sea conference this November.

Sources

• Ars TechnicaMuse, Meta's extraordinarily privileged AI assistant, has a serious 0-day