Meta’s Muse reportedly has zero-day vulnerability that lets attackers take over your Mac

Meta's AI assistant Muse, launched earlier this month, has reportedly been found to have a zero-day vulnerability that could allow attackers to take control of a user's Mac computer. Security expert Patrick Wardle noted the issue on X, stating that the vulnerability could enable local malware or attackers to stealthily hijack a user's Mac.

The vulnerability stems from the macOS permissions Muse requires, potentially allowing the attacker to access and modify the endpoint for transcription dictation, as well as the server address belonging to Meta. From there, the attacker can gain access to the token controlling the Muse account, without needing to deploy any specific trojan or code to steal data.

Muse is designed to run on a dedicated secure computer with its own browser called Muse Secure VM, but security measures built into it were reportedly insufficient to prevent the vulnerability. The zero-day vulnerability is not yet addressed by Meta, but they are likely to respond soon.