Meta 修复 Muse 漏洞：攻击者可借此控制 AI Agent

Meta 已为其 macOS 应用 Muse 发布补丁，此前发现的一项零日漏洞可能允许攻击者接管该 AI Agent。据 Ars Technica 报道，安全研究员 Patrick Wardle 发现的这一漏洞利用了 Muse 一项未公开的设置：该设置可让能够在本地运行代码的潜在攻击者，将转录处理从 Meta 的服务器重定向至其自有端点，从而使攻击者获得对 Muse 账户的访问权限。

据报道，多项设计决策共同促成了这一漏洞，包括 Muse 的听写在云端而非设备端进行，以及任何应用都能够控制 Muse 的全部未公开设置。Wardle 为测试该漏洞而开发的概念验证攻击显示，他能够借助 Muse 拍摄照片并向磁盘写入恶意文件，而 Muse 在许多情况下不会向用户发出警告。

“我们可以操纵这个 Agent，并利用它的权限做任何想做的事。因此，我们不必编写一个功能非常全面、专门窃取数据的 Mac 恶意软件，只要利用这个 AI 助手本身就可以了，”Wardle 告诉 Ars Technica。“至少，他们应该从一开始就考虑安全问题，但他们显然没有这么做。”

这与 Meta 本月早些时候发布这一 AI Agent时，对 Muse 隐私和安全功能的强调形成鲜明对比。Meta 在 Ars 报道发布后的数小时内修复了该漏洞，并称现实世界中的安全担忧较小，因为利用该漏洞需要先获得对用户设备的本地访问权限。

Meta Superintelligence Labs 的 David Singleton 在 X 上表示：“这是一次本地权限提升攻击，而不是远程漏洞利用。因此，要利用它造成危害，恶意代码必须已经在用户机器上、以其用户账户权限运行；对 Muse Mac 应用用户而言，实际风险因此相当低。”“尽管如此，我们仍已为该应用发布热修复，以解决这一问题。”

尽管该问题被迅速处理，Muse 漏洞出现之际，Meta 正试图从竞争对手 AI 提供商手中夺回市场，其 AI Agent 也已面临审视。Amazon 最近阻止 Muse访问其电商平台，并称 Meta 从未获得其许可。不过，这次发布对 Meta 而言仍属成功：在上线后的前 12 天内，Muse 移动应用在美国和加拿大的预估下载量，据报道已超过 ChatGPT 在发布前 12 天的表现，Meta 股价则在周一上涨了 11%。

Meta has issued a patch for its Muse macOS app following the discovery of a zero-day vulnerability that could allow someone to take control of the AI agent. The bug found by security researcher Patrick Wardle utilized an undocumented Muse setting that enabled potential attackers running local code to redirect transcription processing from Meta’s servers to their own endpoint, Ars Technica reports, giving the attacker access to the Muse account.

Several design decisions reportedly enabled this flaw, including having Muse dictation occur in the cloud instead of on-device, and allowing any app to control all of Muse’s undocumented settings. Proof-of-concept attacks developed by Wardle to test the exploit enabled him to take pictures and write malicious files to disk via Muse, which did not alert the user in many cases.

“We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself,” Wardle told Ars Technica. “At the very least, they should be thinking about security from the very start, and they are just not.”

That stands in contrast with the emphasis that Meta placed on Muse’s privacy and security features when it announced the AI agent earlier this month. Meta patched the vulnerability in the hours following the Ars report being published, and asserts that real-world security concerns were minimal because the exploit required local access to the user’s device.

“This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low,” David Singleton of Meta Superintelligence Labs said on X. “Nonetheless, we have issued a hotfix to the app to address the issue.”

While quickly addressed, the Muse exploit comes at a time when Meta’s AI agent is already being scrutinized as the company tries to claw back ground from rival AI providers. Amazon recently blocked Muse from accessing its e-commerce platform and claims Meta never obtained its permission to do so. Still, the launch has been successful for Meta — during its first 12 days, estimated downloads of the Muse mobile app have reportedly outpaced ChatGPT’s own 12-day debut in the US and Canada, with Meta stock climbing by 11 percent on Monday.