Meta 权限极高的 AI 助手 Muse 存在严重 0-day 漏洞

英文标题：Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

Meta CEO 马克·扎克伯格曾高调宣传新 AI 助手 Muse 的隐私与安全能力，但研究人员披露的 0-day 漏洞可能让本地应用或终端命令完全接管该 Agent。该漏洞允许攻击者篡改 Muse 的未公开配置，将语音转录端点指向攻击者控制的服务器，进而窃取账户认证令牌。由于 Muse 获得了文件、麦克风、摄像头、位置、日历及多个在线账户的广泛权限，令牌失窃可能带来严重后果。与此同时，Amazon 已于周日开始阻止 Muse 访问其网站，这进一步引发了业界对该助手安全性的质疑。

打开原文相关 3 · 机会 1

中文

Meta 创始人兼 CEO 马克·扎克伯格不遗余力地宣传其新 AI 助手 Muse 的安全性，声称它“从底层开始便为隐私和安全而构建”。但一个可让本地运行的应用和终端命令完全控制该 Agent 的零日漏洞，令人对这一说法产生严重怀疑。更令人质疑的是，Amazon 已于周日开始阻止 Muse 访问其网站。

Meta 数周前推出了 Muse。该助手可以“预约、填写表单和处理客户服务”，“主动接手你的任务”，并且能够“购物、生成图像、创建文档，以及连接你喜爱的应用和服务”。这款 macOS 应用（耐人寻味的是，它没有 Windows 版本）还可以接入用户的 WhatsApp、电子邮件、日历和社交媒体账户。当某项任务需要一个尚不存在的工具时，Muse 会即时创建一个。

Meta 对 Muse 安全性的吹捧过头了

当然，要让 Muse 完成这些事情，用户首先必须授予它访问自己账户的权限。这包括向每项服务验证该助手的身份；而且由于该应用运行于 macOS，用户还必须允许它访问广泛的、受操作系统限制的设备资源，例如向磁盘写入文件、访问麦克风和摄像头，以及监控位置和日历。Apple 多年来一直在开发这些防御机制，以防止已安装的应用或在终端中输入的命令访问这些资源，显然是因为该公司将其视为安全威胁。Muse 则完全绕过了这些默认防护措施。

这一零日漏洞允许任何应用或终端命令获取用于验证用户 Muse 账户身份的令牌。Meta 开发人员将该助手设计为：任何本地安装的应用或已执行的代码，无论其拥有何种 macOS 权限，都可以更改一长串未公开的设置。其中大多数设置相当无害，例如控制深色模式。然而，有一项设置绝非无害：它允许进程更改执行转录服务的端点。通常，该端点是由 Meta 运营的服务器地址。攻击者可以通过将这一位置改为自己的端点来利用该缺陷。一旦发生这种情况，攻击者便可获得能够完全控制 Muse 账户的令牌。

English / 原文

Meta founder and CEO Mark Zuckerberg has gone to great lengths to hype the security of its new AI assistant Muse, claiming it is “built from the ground up for privacy and security.” A zero-day vulnerability that gives locally run apps and terminal commands complete control of the agent raises serious doubts. Further raising questions, Amazon on Sunday began blocking Muse from its site.

Meta introduced Muse a few weeks ago. The assistant “books appointments, fills out forms and handles customer service,” “proactively takes tasks off your plate,” and can “make purchases, generate images, create documents, and connect with your favorite apps and services.” The macOS app (curiously, there’s no Windows version) also works with a user’s WhatsApp, email, calendar, and social media accounts. When a task requires a tool that doesn’t exist, Muse creates one on the fly.

Meta doth hype Muse security too much

Of course, for Muse to do any of these things, users must first give it access to their accounts. This includes authenticating the assistant to each service and, because the app runs on macOS, giving it permissions to a broad range of operating system-restricted device resources like writing files to disk, accessing the mic and camera, and monitoring location and calendars. Apple has spent years developing these defenses to prevent installed apps or commands entered into the terminal from accessing these resources, clearly because the company considers them a security threat. Muse completely undoes these default measures.

The zero-day allows any app or terminal command to gain access to the token that authenticates users to their Muse account. Meta developers designed the assistant so that any locally installed app or executed code, regardless of the macOS permissions it has, can change a long list of undocumented settings. Most of them are fairly innocuous, such as controlling dark mode. One setting, however, is anything but innocuous. It allows processes to change the endpoint where transcription occurs. Normally, it’s a server address operated by Meta. Attackers can exploit this flaw by changing the location to their own endpoint. Once that happens, the attackers have the token that gives complete control over the Muse account.