Meta Muse macOS flaw could expose assistant data and actions

The flaw arose because any program running under a user’s account could modify Muse’s dictation setting in the app’s local preferences.[1] Locally running apps or terminal commands could then take control of Muse and perform malicious actions.[1] The vulnerability could enable prompt injection, capture dictated audio and prompts, and expose Muse authentication material.[3] The weakness was not remotely exploitable: an attacker had to already be able to run code as the local user, and it could not break into a Mac by itself.[1][2]

The Hacker News reported that an attacker using a captured token could read Muse chat history and control the assistant directly.[2] A compromised Muse account could also let an attacker issue commands to the assistant on other devices signed into that account.[2] In tests described by The Hacker News, Wardle used Muse on an iPhone to report its location, scan nearby Bluetooth devices and list available smart-home commands.[2] CPO Magazine reported that compromising the Muse Agent could provide access to Muse data and capabilities, including a linked iPhone.[1]

Meta released security hotfixes by removing the dictation setting in production builds.[1] Meta said it released a hotfix more than 12 hours after the relevant post went live.[4] The Hacker News reported that Wardle did not notify Meta before publicly disclosing the flaw.[2] After the vulnerability became public, Amazon blocked Muse, saying the assistant violated its Conditions of Use.[1]

Meta describes Muse as an assistant that can book appointments, handle customer service, fill forms and make purchases.[1] It can connect to services including WhatsApp, email, calendars and social-media accounts.[1] Meta says Muse runs in a cloud virtual machine that stores information users share and things they create with the assistant, and that each user’s virtual machine is isolated from other users’ agents.[5] Meta also says Muse asks users to confirm certain important actions, including sending an email or making a purchase.[5]