# Meta 修复 Muse macOS 应用零日漏洞，攻击者可借此操控 AI 智能体

- 来源：The Verge：AI（RSS）
- 作者：Jess Weatherbed
- 发布时间：2026-09-22 19:53
- AIHOT 分数：69
- AIHOT 链接：https://aihot.news/items/cmucn8lun0ghxroedj47ortr0
- 原文链接：https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent

## AI 摘要

Meta 为 Muse macOS 应用发布补丁，修复一个可让攻击者接管 AI 智能体的零日漏洞。安全研究员 Patrick Wardle 发现漏洞利用一个未公开设置，可将转写处理从 Meta 服务器重定向到攻击者端点，从而获取 Muse 账户访问权；概念验证可实现拍照和写入恶意文件且多数情况不提醒用户。

## 正文

‘They should be thinking about security from the very start, and they are just not.’

‘They should be thinking about security from the very start, and they are just not.’

The zero-day exploit required local access to the user’s device, but gave potential attackers access to Muse accounts.

Meta has issued a patch for its Muse macOS app following the discovery of a zero-day vulnerability that could allow someone to take control of the AI agent. The bug found by security researcher Patrick Wardle utilized an undocumented Muse setting that enabled potential attackers running local code to redirect transcription processing from Meta’s servers to their own endpoint, Ars Technica reports, giving the attacker access to the Muse account.

Several design decisions reportedly enabled this flaw, including having Muse dictation occur in the cloud instead of on-device, and allowing any app to control all of Muse’s undocumented settings. Proof-of-concept attacks developed by Wardle to test the exploit enabled him to take pictures and write malicious files to disk via Muse, which did not alert the user in many cases.

“We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself,” Wardle told Ars Technica. “At the very least, they should be thinking about security from the very start, and they are just not.”

That stands in contrast with the emphasis that Meta placed on Muse’s privacy and security features when it announced the AI agent earlier this month. Meta patched the vulnerability in the hours following the Ars report being published, and asserts that real-world security concerns were minimal because the exploit required local access to the user’s device.

“This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low,” David Singleton of Meta Superintelligence Labs said on X. “Nonetheless, we have issued a hotfix to the app to address the issue.”

While quickly addressed, the Muse exploit comes at a time when Meta’s AI agent is already being scrutinized as the company tries to claw back ground from rival AI providers. Amazon recently blocked Muse from accessing its e-commerce platform and claims Meta never obtained its permission to do so. Still, the launch has been successful for Meta — during its first 12 days, estimated downloads of the Muse mobile app have reportedly outpaced ChatGPT’s own 12-day debut in the US and Canada, with Meta stock climbing by 11 percent on Monday.