Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day (arstechnica.com)

Meta's newly launched AI assistant, Muse, which promises enhanced privacy and security, has been found to contain a serious zero-day vulnerability that undermines these claims. This flaw allows locally run apps and terminal commands to gain complete control over Muse, including access to sensitive user data. As a result, Amazon has taken the precautionary step of blocking Muse from its site, highlighting concerns about its security protocols. The Muse assistant is designed to streamline tasks such as booking appointments and managing accounts by integrating with various services like WhatsApp and email. However, its functionality depends on extensive permissions granted by users, which could expose them to risks if an attacker exploits the zero-day vulnerability. Specifically, attackers can alter critical settings, potentially redirecting transcription data to malicious endpoints. This incident raises significant alarms in the AI/ML community regarding the importance of stringent security measures in AI applications, especially those that require deep integration with user accounts and sensitive data.