Meta’s Muse AI assistant can be hijacked through a simple attack
“We can manipulate the agent and leverage its privileges to do whatever we want.”
Image by Cybernews.
- A researcher says Meta’s Muse AI assistant can be hijacked by changing undocumented local settings.
- Attackers can redirect a transcription endpoint, steal the user’s Muse token, and control the assistant.
- The attack still needs local code execution, which a ClickFix-style trick could provide.
- Meta says it has issued a hotfix for the Muse Mac app after the disclosure.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Meta has hyped Muse as a secure AI agent, but security researcher Patrick Wardle says a simple ClickFix-style attack can exploit a zero-day to take control of the agent and its extensive privileges.
Meta introduced Muse as a personal AI assistant that can work across a user’s apps and services, including email, WhatsApp, calendars, and social media. It can book appointments, fill out forms, handle customer service, make purchases, create documents, and build tools when it needs capabilities that it does not already have.
That wide reach also makes Muse an attractive target.
Wardle, a macOS security researcher, found that any locally running application or terminal command can manipulate undocumented Muse settings without needing special macOS permissions. One of those settings controls the endpoint used for transcription.
An attacker can redirect that endpoint from Meta's server to one that they control. Once Muse sends data to the malicious endpoint, the attacker can obtain the token that authenticates the user's Muse account and use it to control the assistant.
“We can manipulate the agent and leverage its privileges to do whatever we want,” Wardle told Ars Technica. “So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.”
Wardle demonstrated the problem with several proof-of-concept attacks. They included writing malicious files to the Mac and taking pictures with the camera, in some cases without producing an obvious warning for the user.
The flaw doesn’t give a remote attacker instant access to every Muse installation. The attacker first needs a way to execute code locally. But Wardle showed that all it takes is a ClickFix-style attack, which tricks users into running commands, to provide the initial foothold.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
New attack surface
The Muse flaw arrives as security researchers increasingly warn that AI agents create a different class of security problem, because attackers don’t always need to compromise the agent itself as long as they can manipulate what the agent sees or exploit its privileges.
Researchers have shown a similar issue in GitHub's Model Context Protocol ecosystem, where a malicious instruction hidden in a public GitHub issue could trick an AI agent into accessing private repositories and exposing their contents.
More recently, a vulnerability in Nvidia's NemoClaw showed how a malicious website could potentially take control of an AI agent after a victim visited the site. The flaw demonstrated another uncomfortable reality that even when developers add a sandbox around an agent, it can still reach systems and data that its legitimate permissions allow it to access.
The Muse flaw is another example of this problem. Giving an AI assistant more authority makes it more useful, but it also increases the damage an attacker can cause when something goes wrong.
Meta has responded to the disclosure by saying it has issued a hotfix for the Muse Mac app.
