Meta patches Muse exploit that let attackers control the AI agent
Meta patches a Muse AI agent zero-day exploit allowing attackers to control the agent, while a Linux KVM flaw enables guest-to-host memory access and a SharePoint flaw enables authenticated remote code execution.
Meta patches a Muse zero-day exploit that allows attackers to control an AI agent, while a Linux KVM flaw gives ARM64 KVM guests read/write host memory and a SharePoint flaw enables authenticated RCE.
- A SharePoint vulnerability enables authenticated RCE via XAML deserialization and an in-memory webshell.
- The flaw was initially listed as a spoofing flaw but is actually a remote code execution vulnerability.
- No exploitation has been reported in the wild; the flaw is not in CISA's KEV catalog.
- A Chinese state-backed group exploited the flaw after it was disclosed.
Full article452 words · extracted from theverge.com · click to collapse
Jess Weatherbed
is a news writer focused on creative industries, computing, and internet culture. Jess started her career at TechRadar, covering news and hardware reviews.
Meta has issued a patch for its Muse macOS app following the discovery of a zero-day vulnerability that could allow someone to take control of the AI agent. The bug found by security researcher Patrick Wardle utilized an undocumented Muse setting that enabled potential attackers running local code to redirect transcription processing from Meta’s servers to their own endpoint, Ars Technica reports, giving the attacker access to the Muse account.
Several design decisions reportedly enabled this flaw, including having Muse dictation occur in the cloud instead of on-device, and allowing any app to control all of Muse’s undocumented settings. Proof-of-concept attacks developed by Wardle to test the exploit enabled him to take pictures and write malicious files to disk via Muse, which did not alert the user in many cases.
“We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself,” Wardle told Ars Technica. “At the very least, they should be thinking about security from the very start, and they are just not.”
That stands in contrast with the emphasis that Meta placed on Muse’s privacy and security features when it announced the AI agent earlier this month. Meta patched the vulnerability in the hours following the Ars report being published, and asserts that real-world security concerns were minimal because the exploit required local access to the user’s device.
“This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low,” David Singleton of Meta Superintelligence Labs said on X. “Nonetheless, we have issued a hotfix to the app to address the issue.”
While quickly addressed, the Muse exploit comes at a time when Meta’s AI agent is already being scrutinized as the company tries to claw back ground from rival AI providers. Amazon recently blocked Muse from accessing its e-commerce platform and claims Meta never obtained its permission to do so. Still, the launch has been successful for Meta — during its first 12 days, estimated downloads of the Muse mobile app have reportedly outpaced ChatGPT’s own 12-day debut in the US and Canada, with Meta stock climbing by 11 percent on Monday.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
- Jess Weatherbed