Meta’s new AI assistant, Muse, has a vulnerability that lets malware on a Mac exploit the AI agent. Security researcher Patrick Wardle published a working proof-of-concept demonstrating how an attacker can gain control of Muse.
Muse was introduced a few weeks ago as a personal AI assistant for macOS. Among other things, the agent can schedule appointments, make purchases, and create documents. To do so, Muse can link to email, calendars, and social media, for example, and access files, the microphone, and the camera.
Rerouting transcription
The vulnerability involves the `endo_voyager_dictation_endpoint` setting, which determines which endpoint voice commands are sent to. Normally, this is Meta’s infrastructure. However, a local process can replace the address with an attacker’s server, Ars Technica explains.
This allows voice commands to be intercepted, and an attacker can add instructions to Muse. The AI assistant’s authentication credentials can also be compromised.
Wardle demonstrated attacks that include writing files to the disk and taking photos, according to Ars Technica. Instead of developing sophisticated malware, an attacker can use Muse to carry out these actions.
Access to the Mac is required first
The vulnerability does not mean that an attacker can simply take over a Mac running Muse from the internet. Code must already be able to run under the user’s account, for example through malware or social engineering.
The problem is that malware with relatively limited privileges can suddenly achieve much more via Muse, reports The Register. macOS security mechanisms that restrict individual apps then offer less protection.
Even a simple ClickFix attack can be enough to execute the necessary local code, according to Ars Technica. In such an attack, a user is tricked into executing a command themselves, for example, in the terminal. The vulnerability in Muse can then be exploited to further escalate the attack.
Cloud processing
Wardle also questions some of Meta’s design choices. For instance, voice commands are processed in the cloud, even though macOS also offers local capabilities for dictation and transcription. According to Wardle, this specific attack would not have been possible with local processing, reports The Register.
In its own explanation of Muse’s security, Meta makes it clear that the company uses, among other things, isolated execution and restrictions on what the agent can do.
The vulnerability exposes a broader risk posed by AI agents. To act independently on a user’s behalf, an agent must access various data and services. Anyone who manipulates such an agent can exploit those capabilities for other purposes.