Meta patches Muse exploit that let attackers control the AI agent
Meta patched a Muse bug that let local attackers hijack the AI assistant and steal data, showing design flaws in its cloud‑based dictation.
Why Now
A zero‑day discovered by Patrick Wardle exposed a Muse setting that could redirect transcription to a malicious endpoint; Meta issued a hotfix the same day.
What Happened
The exploit required local code execution on the user’s Mac and let attackers take pictures, write files, and access the Muse account. Meta said the risk was low because it was a local privilege escalation, not a remote attack. The patch was released within hours of the Ars Technica report.
Why It Matters
It highlights that cloud‑based AI assistants can become attack vectors if undocumented settings are exposed. Users of Muse may have had their data and device compromised without notice, raising concerns about AI security practices.
The Limitation
The report focuses on a local exploit; it does not indicate widespread remote vulnerability or that all Muse users were affected.
What You Can Do
Check that your Muse app is updated to the latest version and review its permissions; consider disabling cloud dictation if possible.
Source
Read original sourceWhy we picked this
Zero‑day vulnerability affecting Meta’s Muse AI agent is core AI security news.