Meta’s Muse AI assistant harbors a zero‑day that bypasses macOS security
According to Ars Technica, a newly discovered zero‑day vulnerability lets any locally‑run macOS app or terminal command hijack the authentication token that powers Meta’s Muse AI assistant. The flaw turns the assistant, marketed as a privacy‑first personal aide, into a backdoor that can write files, snap photos, and issue commands without alerting the user.
What Muse Promises and How It Works
Muse was unveiled a few weeks ago as a macOS‑only AI assistant that can book appointments, fill out forms, make purchases, generate images, and connect to services such as WhatsApp, email, calendars, and social media. To perform those actions the app asks users to grant it access to a wide range of system resources—file system writes, microphone and camera use, location data, and calendar entries. Under normal macOS rules, an app can only touch the resources it is explicitly permitted to, and the operating system isolates apps from each other.
The Zero‑Day Mechanics
The vulnerability works because Muse stores a long list of undocumented settings that any local process can modify, regardless of the process’s own macOS permissions. Most of those settings are harmless (e.g., toggling dark mode), but one setting controls the endpoint for speech transcription. By default the endpoint points to a Meta‑operated server, but an attacker can change it to a server they control. When the user speaks a command, the audio is sent to the attacker’s server, which also receives the authentication token that authorises the Muse account. Possession of that token gives the attacker full control over the assistant, allowing actions such as writing malicious files to disk or taking pictures, all without triggering a user alert.
Why the Privilege Model Backfires
Meta’s design choice to let any local app change Muse’s internal settings directly contradicts Apple’s sandboxing model. macOS sandboxes each app in its own container and requires explicit user consent for privileged resources. By exposing a global token‑changing setting, Muse effectively lifts the sandbox for every process on the machine. The trade‑off is clear: convenience for the user (no need to re‑authorise each new task) versus a massive attack surface. In practice this means that a simple piece of malware—or even a benign utility run from the terminal—can elevate itself to the same level of privilege as Muse, turning the assistant into a shortcut for building macOS malware.
| Feature | Default macOS behavior | Muse’s implementation |
|---|---|---|
| Access to microphone/camera | Granted per‑app after user approval | Granted once during Muse setup and shared with any local process |
| Ability to change app settings | Restricted to the app’s own sandbox | Any local process can modify undocumented Muse settings |
| Transcription endpoint | Handled by secure on‑device APIs or Apple‑approved servers | Configurable via a mutable setting, exploitable to redirect traffic |
| Token storage | Encrypted in the app’s keychain, inaccessible to other apps | Exposed through the mutable setting, retrievable by any process |
The table shows how Muse abandons the isolation that macOS normally enforces. The convenience of “one‑click” integration across services is achieved by handing over control that should remain private to the assistant itself.
Who Wins and Who Loses
Who loses: End users who trusted Meta’s privacy claims now face a potential breach of every connected account—WhatsApp, email, calendar, and any service that Muse can act on. Developers who built integrations expecting Muse to respect macOS permissions must now consider their code a possible attack vector. Amazon, which blocked Muse from its site shortly before the flaw was disclosed, avoids being a conduit for fraudulent purchases.
Who wins: Attackers who can place a proxy server in the transcription path gain a reusable token that can automate purchases, exfiltrate messages, or install persistent malware. The ease of exploiting the flaw—changing a single setting via a terminal command—lowers the barrier to creating Mac‑based malware that previously required more sophisticated privilege‑escalation techniques.
What to Do Right Now
- Revoke Muse’s permissions – Open System Settings → Privacy & Security → Full Disk Access and remove Muse. Also delete the app if you do not need it.
- Rotate credentials – Change passwords and enable two‑factor authentication for any service linked to Muse (email, WhatsApp, social media, banking, etc.).
- Monitor for unexpected activity – Look for new files in your Documents folder, unexplained camera or microphone usage, and unfamiliar login locations in your account logs.
- Stay updated – Keep macOS and all installed applications patched. When Meta releases an update that removes the undocumented setting, apply it immediately.
- Consider alternatives – If you need an AI assistant, choose one that runs transcription locally (Apple’s built‑in dictation) or one that clearly documents its permission model.
By tightening the local permission chain today, you can prevent a rogue process from turning Muse into a malware delivery platform.
