Meta's Muse Zero-Day Lets Local Apps Seize Accounts as Amazon Blocks Assistant
Updated
Updated · Ars Technica · Sep 21
Meta's Muse Zero-Day Lets Local Apps Seize Accounts as Amazon Blocks Assistant
2 articles · Updated · Ars Technica · Sep 21
Summary
A zero-day in Meta’s Muse lets any locally run macOS app or terminal command take full control of a user’s assistant account once Muse has been authorized to access services.
The flaw stems from undocumented settings that local processes can alter regardless of macOS permissions; attackers can redirect Muse’s transcription endpoint to their own server and capture the authentication token.
That token can expose the broad powers users grant Muse, including access to WhatsApp, email, calendars, social accounts, purchases, documents, images, and device resources such as files, microphone, camera, and location.
Amazon began blocking Muse from its site on Sunday, adding to scrutiny of a product Mark Zuckerberg had promoted as built “from the ground up for privacy and security.”