Meta’s new AI assistant, Muse, had a flaw that let any app or Terminal command on a Mac take over a user’s Muse account, Ars Technica reported on 21 September. The macOS security researcher Patrick Wardle found it; Meta released a hotfix more than 12 hours after the story was published.
What Muse is, and why the flaw mattered
Muse is an agent: Meta says it books appointments, fills out forms, handles customer service, makes purchases and connects to your apps and services. The macOS app (there is no Windows version, Ars notes) also works with WhatsApp, email, calendar and social media accounts. To do all that it asks for a lot: access to your accounts, and macOS permissions for files, the microphone and camera, location and calendars, the very resources Apple has spent years fencing off from ordinary apps.
How it worked, in plain words
Muse exposed a long list of undocumented settings that any locally installed app or executed code could change, whatever macOS permissions that code had. Most were harmless, like dark mode. One was not: the address of the server that transcribes your voice. Normally it points at Meta. An attacker who changed it to their own server received the token that authenticates you to Muse, which gave complete control of the account.
So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.
Patrick Wardle, quoted by Ars Technica
Wardle said he built proof-of-concept attacks that wrote files to disk and took pictures, in many cases with no sign an alert user would notice. And the attacker didn’t need a sophisticated break-in: a simple variation of ClickFix, the scam that talks people into pasting a command into Terminal, was enough. With the attacker’s server sitting between you and Meta, it could add its own instructions to your voice prompts, such as sending an archive of all your WhatsApp messages.
Wardle also pointed at a design choice: Muse sends dictation to the cloud, where Meta can log it, although macOS offers a way for apps to transcribe on the device. Had Muse used it, Ars reports, this attack wouldn’t have been possible. Meta’s statement said the issue was “not a remote exploit”. Separately, Amazon began blocking Muse from shopping on its site, calling it an “unauthorized AI agent”.
What to do if you use Muse, or any AI agent on your Mac
- Update Muse so the hotfix is installed.
- Look at what you have granted: System Settings › Privacy & Security lists which apps can use your camera, microphone, files, location and calendars. Remove anything an assistant doesn’t truly need.
- Never paste a command from a web page or chat into Terminal. It was enough to trigger this attack.
- Treat an AI agent like a person you’ve given your keys to: connect only the accounts you would be comfortable losing control of.
Where FireAI fits, and where it doesn’t
The attack came down to one thing a firewall can see: an app that normally talks to one company’s servers suddenly sending your voice somewhere else.
- With FireAI you can allow an AI app only to the destinations it needs, per app. If you allowed an assistant just to its maker’s domains, a connection to a new, unknown server doesn’t match your rule: FireAI asks you, or blocks it outright in Under attack mode. If you had allowed that app to connect anywhere, it wouldn’t ask, so scope your rules.
- The world map shows where each app’s traffic actually goes, so an assistant sending audio to an unfamiliar country is visible, not hidden.
- Camera & mic shows which app turned the camera or microphone on, and what it sent meanwhile.
- FireAI’s own AI runs on your Mac. What it analyses isn’t sent to any cloud, the on-device approach Wardle pointed to for dictation.
FireAI can’t fix a flaw inside another company’s app, and it can’t stop a local program from changing that app’s settings. What it gives you is the view, and the veto, on where your apps send your data. Download FireAI and try it free for 17 days. FireAI is made by HisnLabs.