Meta addresses security flaw in Muse app that could allow remote control of AI agent

Meta has released a patch for its Muse macOS application after a zero-day vulnerability was discovered, which could enable attackers to gain control of the AI agent. The flaw, identified by security researcher Patrick Wardle, exploited an undocumented Muse setting, allowing local code to redirect transcription processing from Meta's servers to an attacker's endpoint, granting access to the Muse account. The vulnerability was made possible by design choices such as cloud-based dictation and the ability for any app to control Muse's undocumented settings. Wardle's findings were reported by Ars Technica. The issue highlights potential risks in the deployment of AI assistants, as the flaw could be exploited through a simple ClickFix attack, as noted in a previously published article. The patch aims to mitigate these risks by addressing the specific vulnerability.