Researchers disclose zero-day vulnerability in Meta’s Muse AI assistant enabling full account takeover

Meta’s Muse AI assistant, introduced as a macOS application with deep system access to calendars, WhatsApp, email, and other services, contains a zero-day vulnerability that allows any locally installed app or terminal command to hijack the authentication token used by Muse, granting attackers full control over the user’s account and associated privileges.

The flaw arises from undocumented settings exposed by Muse’s design, including the ability to change the endpoint where transcription occurs. Normally, transcription is handled by Meta’s servers, but attackers can redirect this endpoint to a server they control, thereby capturing the authentication token and enabling persistent access to the user’s Muse account.

macOS security expert Patrick Wardle, who discovered the vulnerability, demonstrated proof-of-concept attacks that could write malicious files to disk or capture images without triggering user alerts. Wardle emphasized the severity of the issue, stating that attackers can "leverage the AI assistant itself" to perform malicious actions, reducing the need for traditional malware.

Wardle attributed the vulnerability to several design decisions, including reliance on cloud-based transcription and the exposure of undocumented settings to any locally installed app. He noted that macOS provides secure, on-device alternatives for transcription, which Muse could have used to mitigate the risk.

Meta has not responded to requests for comment. The company previously published posts outlining its security and privacy design choices for Muse, framed as efforts to ensure safety amid broader concerns about AI development and third-party network breaches involving models from other labs.

Amazon began blocking Muse from its platform approximately 12 hours before Wardle’s disclosure, citing violations of its Conditions of Use for third-party AI agents. The company stated that such agents must operate openly and respect service providers’ decisions, and requested Meta remove Amazon from the Muse experience.