Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day
ID: 13cceab0-c5c0-5ee7-8856-1b74e2e5f600
STIX ID: report--13cceab0-c5c0-5ee7-8856-1b74e2e5f600
Feed Name: Ars Technica Security (category)
Threat Score
## Executive Summary A zero-day in Meta's Muse macOS application permits local apps or terminal commands to obtain the Muse authentication token by altering an undocumented transcription endpoint, effectively granting attackers full control of the Muse account and access to linked services (WhatsApp, email, calendar) and device resources. The flaw bypasses macOS permission protections and has prompted responses such as Amazon blocking Muse from its site.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.