A flaw in Muse, Meta's AI assistant for Mac, let any app or Terminal command already running on a Mac take over a user's Muse account, Ars Technica reported on 21 September. The macOS security researcher Patrick Wardle found the flaw; Meta released a hotfix more than 12 hours after the report was published.
Background
Muse is built as an agent: Meta says it books appointments, fills out forms, handles customer service, makes purchases and connects to a user's other apps and services. The macOS app, for which Ars notes there is no Windows equivalent, also works with WhatsApp, email, calendar and social-media accounts. To do that, Muse asks for broad access: to those accounts, and to macOS permissions covering files, the microphone and camera, location and calendars, the categories Apple otherwise fences off from ordinary apps [1].
Findings
According to Ars Technica's report, Muse exposed a long list of undocumented settings that any locally installed app or executed code could change, regardless of the macOS permissions that code held. Most of those settings were minor, such as switching to dark mode. One was not: the address of the server that transcribes a user's voice. That address normally points to Meta. An attacker who redirected it to a server they controlled received the authentication token for the user's Muse account, giving them complete control of it [1].
So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.
Patrick Wardle, quoted by Ars Technica
Wardle told Ars he built proof-of-concept attacks that wrote files to disk and took pictures, in several cases without a sign that an attentive user would notice. The attacker did not need a sophisticated break-in: a variation of ClickFix, the technique that talks people into pasting a command into Terminal, was enough to trigger the redirect. With their own server positioned between the user and Meta, an attacker could also insert instructions into the user's voice prompts, such as one instructing Muse to send an archive of the user's WhatsApp messages [1].
Wardle also pointed to a design choice: Muse sends dictation to the cloud, where Meta can log it, even though macOS provides an API for on-device transcription. Ars reports that had Muse used that API, this attack would not have been possible. Meta's statement to Ars described the issue as "not a remote exploit". Separately, Amazon began blocking Muse from making purchases on its site, describing it as an "unauthorized AI agent" [1].
Implications for Mac users
The flaw affected any Mac with Muse installed before the hotfix; Ars does not report Meta disclosing how many users were exposed or whether the flaw was exploited outside Wardle's testing. Anyone running Muse, or any AI assistant with similarly broad account and system access, was implicitly trusting that no other app or pasted command on the same Mac could reach the assistant's settings. This flaw shows that trust was not guaranteed by Muse's own design.
Recommendations
- Update Muse so the hotfix Meta shipped is installed.
- Review what has been granted in System Settings › Privacy & Security, which lists every app with access to the camera, microphone, files, location and calendars. Remove access an assistant does not need.
- Never paste a command from a web page or a chat into Terminal; that step was enough to trigger this attack.
- Connect an AI agent only to the accounts you would accept losing control of, given the scope of access these tools request.
Relevance to FireAI
The attack came down to something a firewall can observe: an app that normally talks only to its maker's servers suddenly sending data somewhere else. With FireAI, an app can be allowed to connect only to the destinations it needs. If an assistant is scoped to its maker's domains, a connection to a new, unrecognised server does not match that rule, so FireAI asks about it, or blocks it outright in Under attack mode; a rule that allows an app to connect anywhere would not trigger that check. The world map shows where each app's traffic goes, and Camera & mic shows which app activated the camera or microphone and what it sent while it was on. FireAI's own AI, which analyses connections and explains them in plain language, runs on the Mac rather than a cloud server, the approach Wardle pointed to for dictation.
FireAI cannot fix a flaw inside another company's app, and it cannot stop a local program from changing that app's own settings. What it provides is visibility into, and a veto over, where an installed app sends data.
Limitations
Ars Technica's report does not state whether the flaw was exploited against real users before Wardle's disclosure, or how Meta verified that no accounts had already been compromised. Meta's characterisation of the issue as "not a remote exploit" is the company's own framing, reported by Ars alongside Wardle's findings; the two accounts are not fully reconciled in the source. The report also does not say whether Muse's other undocumented settings, beyond the transcription-server address, carry similar risk.
Try FireAI, by HisnLabs free for 17 days.