Muse for Mac zero-day lets malware hijack dictated prompts
A researcher released a Muse for Mac zero-day in which an unprivileged local process can change a hidden setting and send dictated prompts to an attacker's server, plus steal authentication material and access to files, Mail and Messages.
‼️ BREAKING: A zero-day has been released for Muse, Meta's new AI agent, and a Meta AI security engineering manager who left the company this month says he would never use it, citing security and privacy concerns. He was reacting to the zero-day a researcher posted, which lets malware hijack Muse for Mac. A local process with no special privileges can change an undocumented Muse setting and send dictated prompts to an attacker's server. This could allow for prompt capture, prompt injection and theft of Muse's authentication material. It can also get access to whatever the user has let Muse access, including files, Mail, Messages, Calendar and Notes.