An AI assistant is supposed to make your life easier. Muse, Meta’s new AI agent for Mac, may have also made things easier for hackers. Security researcher Patrick Wardle discovered a zero-day vulnerability in Muse that could allow an attacker who already had code running on a Mac to take control of the AI agent and abuse its access to sensitive data and device functions.
Wardle demonstrated proof-of-concept attacks that could make Muse take pictures and write malicious files to the Mac, in some cases without alerting the user. Meta patched the vulnerability shortly after the flaw was reported.
Muse has a lot of access
AI assistants are rapidly evolving from glorified chatbots into agents that can actually do stuff. Muse can handle tasks such as booking appointments, filling out forms, creating documents, making purchases and interacting with services including WhatsApp, email, calendars and social platforms. On Mac, it can also interact with files, messages, notes and mail.
That usefulness comes with a price: permissions. Depending on what a user allows, Muse can gain access to resources such as files, the microphone, camera, location and calendar. That means compromising the agent could potentially give an attacker a much bigger playground than compromising an ordinary app.
Wardle’s concern is why bother building a traditional Mac malware tool to steal everything separately when an AI agent already has permission to reach much of it? “We can manipulate the agent and leverage its privileges to do whatever we want,” he told Ars Technica.
The setting that opened the door
The vulnerability centered on an undocumented Muse configuration setting controlling where dictation transcription was processed. Muse normally sends dictation to a server for transcription. Wardle found that a locally running application or terminal command could change that destination to a server controlled by an attacker.
That could allow the attacker to capture voice prompts and obtain the authentication token associated with the victim’s Muse account. Once they had that token, the attacker could effectively control the Muse agent.
The problem was made worse by Muse allowing locally installed apps to control its undocumented settings, according to Wardle’s analysis.
You still need a way onto the Mac
This was not a remote-code-execution flaw that lets someone randomly pick a Mac and take it over. An attacker first needed malicious code running locally on the computer. That could come from malware, a malicious application or social engineering.
Meta has emphasized the distinction. According to David Singleton of Meta Superintelligence Labs, the vulnerability was a local privilege-escalation attack rather than a remote exploit, arguing that the practical risk was low because malicious code would already need to be running on the machine.
Meta nevertheless released a hotfix to address the problem. The problem is that getting malware onto a Mac is not exactly science fiction. Infostealers and social-engineering tricks such as ClickFix attacks are already being used to convince people to run malicious commands. And once something is running locally, Muse potentially gives that malware a much more convenient interface for reaching things the user has already authorized.
What Mac users should do
Wardle’s advice regarding Muse was simply to not install it. For anyone already using AI agents, it is important to not give an agent access to everything just because it asks. Keep permissions limited to what the agent actually needs. Review connected accounts regularly and remove access you no longer use.
And remember that AI agents can encounter instructions inside webpages, emails and documents. Those instructions are not automatically trustworthy just because the AI is reading them.
It is also worth watching for strange behavior, such as an agent suddenly asking for new permissions, requesting account reauthentication, sharing files externally or performing actions you didn’t initiate.
Above all, stay ahead of basic Mac security. Keeping software updated, using reputable real-time malware protection and not blindly following instructions from websites or unsolicited messages telling you to paste commands into Terminal are very good practices to follow.
Sources: Malwarebytes, The Verge