Meta’s do-it-all AI assistant Muse launched two weeks ago, and the company has already had to patch a pretty serious zero-day vulnerability in its app for Mac computers.
David Singleton, who works at Meta Superintelligence Labs, said shortly after midnight Tuesday that the company had issued a “hotfix” for the vulnerability.
Meta launched Muse on Sept. 8 as a personal AI agent that can handle tasks like sending emails, booking travel, shopping, and tracking goals. To do all that, users give Muse access to a wide range of apps, accounts, and device features, making any vulnerability that could hijack the agent particularly concerning.
“We strive to be extremely transparent about privacy and security in Muse as we know this is important to maintain your trust,” Singleton wrote in a post on X explaining the issue.
The vulnerability involved Muse’s dictation feature, which sends audio to Meta’s servers for transcription rather than processing it locally on a user’s Mac.
According to Singleton, the version of Muse that shipped included an internal setting that allowed developers to change the server endpoint used for the dictation feature, something he said was useful for debugging and development. The problem was that the setting lives on the app’s local preferences and could be changed by other programs running under the user’s account.
That meant an attacker who already had code running on the Mac could redirect Muse’s dictation traffic to a server they controlled. That server could then receive the user’s dictated audio along with an authentication token for their Muse account.
From there, an attacker could effectively hijack Muse and take advantage of permissions the user had already given the assistant.
The vulnerability was discovered by Mac security researcher Patrick Wardle, who disclosed his findings Monday. Wardle told Ars Technica that he developed several proof-of-concept attacks that did things like “writing malicious files to disk and snapping pictures, in many cases with no indication to even an alert user.”
Meta pushed back somewhat on how much danger the vulnerability actually posed, pointing out that an attacker first needed to get malicious code running on the victim’s computer.
“This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low. Nonetheless, we have issued a hotfix to the app to address the issue,” wrote Singleton.
Singleton said Meta fixed the vulnerability by removing the setting that allowed the dictation endpoint to be changed.
Wardle, however, argues that requiring code to already be running on a Mac doesn’t necessarily make the flaw difficult to exploit. He said that it could be abused through a ClickFix-style attack where a victim is tricked into copying and running a malicious command on their computer.
This isn’t the only trouble Muse has run into since launch.
Amazon confirmed to Gizmodo on Monday that it had asked Meta to stop allowing Muse to shop on Amazon.com on users’ behalf. Amazon said Meta did not notify the company in advance that Muse would be accessing its site and that the agent does not identify itself while shopping. The company also raised concerns about how Muse handles customer credentials and account data.
Meta did not immediately respond to a request for comment.
Read the full article here
