Key Takeaways:
- Security researcher Patrick Wardle found a serious Meta Muse AI vulnerability, a zero-day flaw in Meta Muse.
- The flaw allows malware already on a device to redirect app traffic to hackers.
- Attackers can steal account tokens and gain full control of users’ accounts.
Security Flaw Exposes Meta Muse Assistant To Local Malware Attacks
Security researcher Patrick Wardle discovered a serious security flaw in Meta’s Muse AI app. The flaw allows malware already running on a computer to intercept user prompts, record dictated audio, and steal sensitive login data. Wardle shared his findings along with a working exploit called “not a mused.” His research shows that users could face hidden security risks when running the app on personal computers.
The flaw targets a hidden setting inside the app that is not documented by Meta. Malicious programs already running on the computer can change this setting without needing extra user permissions. This action sends audio and text traffic to an outside server controlled by attackers. Once the traffic is redirected, attackers can change the instructions sent to the assistant.
Flawed App Permissions Bypass Standard Operating System Privacy Protections
Meta designed its new assistant app with wide access to computer resources. Users must permit it to write files, record audio, and view calendar events. Apple uses built-in privacy controls to prevent regular apps from accessing this type of sensitive information. However, this flaw can get around those protections and put personal data at risk.
Any malicious program on the device can make use of the wide permissions given to the assistant app, highlighting the Meta Muse AI vulnerability. Attackers can then access tokens used to log users into private accounts. Because the app has broad access, a single security breach can create serious risks. Attackers may also misuse connected resources and carry out other harmful actions on the affected device.
The app can work with files, browse the web, and manage emails in the background. It can also ask for approval before taking sensitive actions and keep detailed records of its activity. When an attacker takes control of this trusted connection, they can interfere with many parts of the user’s digital workflow.
Tech Companies Take Action As Security Concerns Grow
Chief executive Mark Zuckerberg previously said the assistant was built from the ground up with privacy and security in mind. Despite those public claims, the latest Meta Muse AI vulnerability discovery has raised concerns about the app’s security. Security experts warn that AI tools with broad access to computer systems can create major risks if something goes wrong.
Other major technology companies are also responding to the growing security concerns. Amazon recently began blocking the application from operating on its website. Other major platforms may take similar steps as further investigations look for more software flaws.
Users can protect their devices by stopping the app and checking its permissions. Experts also recommend changing login credentials if a system may have been compromised. Security teams are continuing to watch networks for unusual activity or unexpected changes to device settings.
Visit CyberPro Magazine For The Most Recent Information.
