Meta’s Muse AI Assistant Rolled Out With a Serious Security Flaw

Meta's new AI assistant was released with a serious security vulnerability that would have allowed attackers to gain complete control over a user's account and device. The flaw worked because the assistant was designed to let any locally installed app or terminal command access sensitive settings, including one that controls where voice data is processed, which an attacker could redirect to their own server to steal authentication credentials. This matters because the assistant has broad access to user accounts, files, cameras, and personal data across multiple services, making such vulnerabilities particularly dangerous. Meta released a fix about 12 hours after the vulnerability was disclosed, and the incident raises questions about whether the company prioritized security in the design process, particularly given the extraordinary access the assistant requires.