macOS security researcher Patrick Wardle disclosed a significant zero-day in Meta's Muse that lets locally installed apps or terminal commands hijack the assistant by redirecting its cloud voice-transcription endpoint to steal auth tokens, enabling full account takeover, file writes, and image capture with no user notification. Meta released a hotfix more than 12 hours after disclosure. Separately, Amazon began blocking Muse on Sunday, saying unauthorized third-party agents violate its terms and demanding Meta remove the retailer from Muse's services.
Useful?