Amazon Blocks Muse After Discovery of a Zero-Day Vulnerability

A zero-day vulnerability in Meta's Muse assistant allows local applications or terminal commands to seize the authentication token and control the agent. Amazon has begun blocking purchases made through Muse on its site and has stated that it requested Meta to remove Amazon from the experience. Critics point to design choices, including cloud-based dictation and undocumented settings accessible to any application.

Amazon Rejects Muse for Purchases and Alerts Meta

About 12 hours before the public disclosure of the vulnerability by Patrick Wardle, Amazon started blocking purchases made via Muse on its site. Affected users received a message stating that Muse is an unauthorized AI agent that violates Amazon's Terms of Service. Amazon clarifies that third-party applications making purchases on behalf of customers of other businesses must operate transparently and respect the decisions of service providers. According to the company, these requirements aim to ensure a safe, secure, and reliable customer experience, similar to other sectors like food delivery or ticket booking. Amazon also indicated that it requested Meta to remove Amazon from the experience offered by Muse.

Token Theft and Persistent Control via Endpoint Hijacking

The zero-day vulnerability allows an application or terminal command to access the token that authenticates a Muse account. Among the undocumented settings, one allows modification of the transcription endpoint, which is normally managed by Meta. By redirecting this endpoint to a server controlled by an attacker, they can retrieve the token and gain full control over the Muse account. One attack method involves placing a proxy server between the user and Meta's endpoint to inject a malicious prompt, such as sending a WhatsApp message archive. Once the operation is completed, the token is transmitted to the malicious server, giving the attacker persistent access to the account.

Questionable Design Choices for Dictation and Settings

Patrick Wardle criticizes several decisions that facilitated the exploitation of the vulnerability. He cites the cloud-based dictation processing, where Meta can record it, while macOS has long offered a secure on-device dictation and transcription mechanism. According to him, if this local solution had been adopted, the attack would not have been possible. He also criticizes the ability for any application to control undocumented settings, particularly the one that changes the endpoint where sensitive speech is processed. Given the extent of Muse's access, he believes that the security requirements should be much higher and that security was not considered from the design stage.

Muse's Capabilities and Account Access Scope

Introduced a few weeks ago, Muse aims for extensive uses: scheduling appointments, filling out forms, managing customer service, making purchases, generating images, creating documents, and connecting to third-party services. The application exists on macOS, with no Windows version, and interfaces with WhatsApp, email, calendars, and social networks. To function, it must be authenticated on each service and obtain system permissions, including file writing, access to the microphone and camera, as well as monitoring location and calendars. Apple has designed protections to frame these sensitive accesses at the system level.

Discovery, Attack Demonstrations, and Lack of Response from Meta

macOS expert Patrick Wardle is behind the discovery of this zero-day vulnerability. He claims to be able to manipulate the agent and has developed proof-of-concept demonstrations that allow writing malicious files or taking photos without alerting the user. He also showed that a simple terminal command can discreetly send a prompt to Meta's endpoint, to which Muse responds, even falsely claiming that such an action was not possible from a non-privileged attacker. Wardle indicates that a variant of the ClickFix attack is sufficient to take control of an account and disputes the notion that all security guarantees would be nullified once the device is compromised. Meta has not responded to email inquiries. However, the company recently published two articles detailing its design choices for security and privacy, in a context where internal testing at Anthropic and Google has led to unintentional breaches of third-party networks and fueled calls to slow down AI development. Wardle plans to detail these elements at the Objective by the Sea conference in November. Despite initial assurances from Mark Zuckerberg regarding Muse's security, the revealed vulnerability allows total access, and the reliability of the agent remains uncertain.