Security hole in Meta's AI app Muse gave access to entire computer

Muse is Meta's new AI assistant for Mac computers. The app can book appointments, fill out forms, handle customer service and connect to WhatsApp, email, calendar and social media, among other things. There is only a version for Mac, not for Windows.

To be able to do all this, users must give Muse access to many sensitive parts of the computer, such as the microphone, camera, location and files.

Security researcher Patrick Wardle discovered a serious vulnerability, a so-called zero-day (a security hole the software maker did not know about and therefore had not yet had time to close). The flaw meant that any other program or command on the computer could take over the code (a token) that proves to Muse who the user is.

Attackers could exploit the hole by changing where Muse sends audio recordings for speech-to-text conversion. Normally the audio is sent to a server at Meta, but by pointing it to their own server, attackers could steal the code and thereby gain full control over the user's Muse account.

With that control, an attacker could get the assistant to do almost anything, for example write malicious files to the computer or take pictures with the camera, often without the user noticing.

Fixed quickly, but doubts remain

Meta had otherwise emphasized that Muse was "built from the ground up with a focus on privacy and security." The vulnerability raises doubts about that claim.

Meta fixed the flaw with a hotfix (a quick software update) within about 12 hours after the case was made public. At the same time, Amazon began blocking Muse on its site.

The case shows a bigger risk with AI assistants: when one app gets access to so many parts of your digital life (accounts, calendar, camera and files), a single flaw can potentially give attackers access to all of it at once.