Meta's Muse AI Agent Patched After Critical Vulnerabilities Allow Access to User Data

Meta's personal AI agent Muse, launched just weeks ago, disclosed critical security vulnerabilities that could grant attackers access to user emails, files, and sensitive personal information. The vulnerabilities emerged within two weeks of Muse's September 8 debut, with security researcher Patrick Wardle disclosing a zero-day hijacking flaw on September 21 that could redirect voice commands to attacker-controlled servers on Mac systems. Meta issued a hotfix within hours, removing an undocumented configuration setting that enabled the attack, but researchers have since identified additional prompt-injection flaws that allow extraction of entire system files with minimal prompting.