Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

Meta's artificially intelligent assistant, Muse, has recently been released, boasting claims of unparalleled privacy and security. However, a recently discovered zero-day vulnerability has cast serious doubts on Meta's assurances. This security flaw allows locally run applications and terminal commands to gain complete control over Muse, raising significant concerns about the privacy and security of user data.

In addition to the zero-day vulnerability, Amazon has begun blocking Muse from its platform, further casting doubt on the assistant's safety. Muse, which is only available on macOS, boasts a wide range of capabilities, including booking appointments, filling out forms, handling customer service, making purchases, generating images, creating documents, and connecting with various apps and services.

To perform these tasks, users must grant Muse access to their accounts, including authenticating the assistant with each service and granting it permissions to a broad range of operating system resources. These permissions include writing files to disk, accessing the mic and camera, and monitoring location and calendars. This is a significant departure from Apple's default security measures, which are designed to prevent installed apps or terminal commands from accessing these resources due to the perceived security threat they pose.

The introduction of Muse has sparked concerns among users and observers alike, who are questioning Meta's claims of security and privacy. The zero-day vulnerability, coupled with the lack of a Windows version and Amazon's blocking of the assistant, suggests that Muse may not live up to the hype surrounding its security features.