MUSE, META'S EXTRAORDINARILY PRIVILEGED AI ASSISTANT, HAS A SERIOUS 0-DAY

Summary from the TLDR InfoSec newsletter

A zero-day allows any local macOS app or terminal command to redirect Muse transcription to an attacker-controlled server. The server receives the account token, enabling control over Muse and its connected email, WhatsApp, calendar, social accounts, microphone, camera, and files. Researcher Patrick Wardle demonstrated prompts that write files or take photos. Amazon also blocked Muse shopping requests as unauthorized.