Security researcher finds flaw letting any app hijack Meta's Muse assistant

A security researcher has found a critical flaw in Muse, Meta’s AI assistant for macOS, that lets any locally installed app or terminal command take over a user’s account. Patrick Wardle, a macOS security researcher, found the zero-day, a previously unknown, unpatched security flaw, and disclosed it publicly. Meta launched Muse a few weeks ago, pitching it as an assistant that books appointments, fills out forms, handles customer service and makes purchases on a user’s behalf.

The flaw sits in how Muse handles voice transcription. Meta designed the assistant so any app or command running on a Mac, regardless of its own permissions, can change a long list of undocumented settings. Most control minor things like dark mode. One controls the server address where Muse sends a user’s voice for transcription. Wardle found that redirecting that address to a server he controlled handed him the authentication token that governs full access to the victim’s Muse account.

Wardle said exploiting the flaw took nothing more elaborate than a ClickFix attack, tricking users into pasting malicious commands, often via a compromised webpage. In tests, he used the stolen token to write files to disk and snap photos through the account, often without any visible sign to the user. “To me, the bar is infinitely higher in terms of the security of these apps,” Wardle told Ars Technica. “They don’t have to be perfect, but when you take a look at Muse, it’s like they didn’t, in my opinion, think about security, which is really worrisome. At the very least, they should be thinking about security from the very start, and they are just not.”

Separately, Amazon began blocking Muse from its site on Sunday, roughly 12 hours before Wardle disclosed the vulnerability. Users who tried to shop through Muse saw a message calling it an “unauthorized AI agent” that violates Amazon’s Conditions of Use. Amazon said in a statement that third-party apps making purchases on customers’ behalf should “operate openly and respect service provider decisions about whether or not to participate,” and said it had asked Meta to remove Amazon from the experience.

Meta has published posts describing Muse as “built from the ground up for privacy and security,” and the app requests broad macOS permissions, including access to the microphone, camera, location and calendar, plus a user’s WhatsApp, email and social media accounts. Meta did not respond to emailed questions about the vulnerability. Wardle said the design choice to process voice dictation on Meta’s servers, rather than on the device as macOS allows, is what made the attack possible in the first place.

Wardle, founder of the Objective-See Foundation and author of “The Art of Mac Malware,” said he plans to describe the flaw and other AI assistant risks in more detail at the Objective by the Sea security conference in November. Meta has not said whether or when it will fix the underlying settings flaw, and it remains unclear if the transcription endpoint can still be redirected by unauthorized processes.