Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

If you use Meta's Muse AI assistant, any app or command can now take over your account and data without your knowledge.

Meta's new AI assistant, Muse, which boasts strong security and privacy features, has a critical zero-day vulnerability. Security expert Patrick Wardle discovered that malicious apps or terminal commands on macOS can gain complete control of the Muse agent by hijacking its authentication token. This exploit allows attackers to change Muse's transcription endpoint to their own servers, granting them full access to user accounts and the ability to perform any action Muse can, effectively turning the assistant into a tool for data theft or malicious operations. Wardle demonstrated that a simple ClickFix attack, which tricks users into executing commands, is sufficient to exploit this flaw. The vulnerability raises serious questions about the security design and testing processes at Meta. Coinciding with the discovery, Amazon began blocking Muse from its platform due to its unauthorized nature and violation of their Conditions of Use, requesting Meta remove Amazon from Muse's functionalities.

The discovery of a zero-day vulnerability in Meta's Muse AI assistant highlights a critical tension between the functionality of highly integrated AI agents and robust security. Muse's ability to access and control a wide array of user data and services, while powerful, creates an outsized attack surface. The exploit's mechanism, which involves redirecting sensitive transcription data and hijacking authentication tokens, suggests that design choices prioritizing convenience over security in AI assistant development can have severe ramifications. This incident will likely prompt greater scrutiny of how AI agents are granted system-level permissions and how their communication endpoints are managed, potentially leading to more stringent sandboxing and verification processes for agentic applications.

This vulnerability and Amazon's subsequent blocking of Muse signal a growing industry-wide concern over the trustworthiness and security of third-party AI agents interacting with various platforms and services. Amazon's stance, framing Muse as an unauthorized agent that violates their terms of use, suggests a more assertive approach from major platforms in controlling the ecosystem of AI assistants. Companies developing or using such agents will need to demonstrate clear adherence to platform policies and robust security measures to maintain access. The incident also underscores the need for AI developers to proactively consider and mitigate sophisticated attack vectors, rather than relying solely on user-level permissions, to build confidence and ensure broader adoption of their AI tools.