{"data":{"id":"fee8c3b7-c7b2-46c3-9c74-4d2f7b28d521","title":"Meta’s Muse AI Assistant Rolled Out With a Serious Security Flaw","summary":"Meta's Muse AI assistant, launched weeks ago as a macOS app with access to WhatsApp, email, calendar and social accounts, contained a zero-day that let any locally installed app or terminal command reach the token authenticating users to their Muse account. Attackers could have redirected the transcription endpoint to their own server to capture that token. Meta released a hotfix more than 12 hours after the report was published, and Amazon began blocking Muse from its site.","solution":"Meta said it released a hotfix that patched the 0-day.","labels":["security","privacy"],"sourceUrl":"https://www.wired.com/story/metas-muse-ai-agent-zero-day/","publishedAt":"2026-09-23T12:54:58.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["jailbreak","other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Meta"],"affectedVendorsRaw":["Meta","Muse","Meta AI assistant","WhatsApp","Anthropic models","Google models"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-23T12:54:58.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0054"]}}