Muse on Mac: Meta Fixes a Local Zero-Day

Meta has released a patch for Muse on macOS following the discovery of a locally exploitable zero-day vulnerability. Researcher Patrick Wardle was able to hijack the agent and perform actions on the machine without user alerts. Meta cites a low practical risk and claims to have responded swiftly.

Amazon Blocks Muse, Initial Downloads Surpass ChatGPT

Amazon recently blocked Muse's access to its e-commerce platform, stating that Meta never obtained permission for this access. Despite this incident, estimates suggest that during its first 12 days, the Muse mobile app recorded more downloads than ChatGPT in the same period in the United States and Canada. Meta's stock rose by 11% on Monday. This security flaw comes as Meta's AI agent is already under scrutiny amid increased competition.

Meta Describes the Exploit as Local Privilege Escalation with "Fairly Low" Risk

Meta believes that the concrete risk to users remains limited, as the attack requires local access to the device. David Singleton from Meta Superintelligence Labs clarifies that it was a local privilege escalation attack, not a remote exploit. According to him, causing damage would imply that malicious code was already running under the user's account, which makes the practical risk "fairly low" for Muse users on Mac.

An Undocumented Setting Redirected Transcription to an Attacker's Server

Patrick Wardle, a security researcher, identified a bug that relies on the use of an undocumented Muse setting. Malicious individuals capable of executing code locally had the ability to redirect transcription, typically processed by Meta's servers, to an endpoint under their control, allowing them to access the victim's Muse account. According to Wardle, two technical decisions made this vulnerability possible: the choice to perform dictation in the cloud rather than on the terminal, and the fact that any application could modify Muse's undocumented settings.

Proof of Concept: Screenshots and Files Written Without Alerts

To test the exploit, Patrick Wardle developed proof-of-concept attacks that allowed him to take photos via Muse and write malicious files to the disk, often without alerting the user. He claims it is possible to manipulate the agent and exploit its privileges, while criticizing the lack of security considerations from the design stage. This finding contrasts with the privacy and security promises highlighted by Meta when announcing Muse earlier this month. Meta has released an urgent patch for macOS within hours of the report's publication.