Meta Muse hidden settings vulnerability lets attackers hijack AI assistant voice commands

Panda Security reports that Patrick Wardle disclosed a local privilege escalation vulnerability in the Meta Muse macOS client. Malicious code must already be running under the logged-in user account to potentially use the assistant's existing privileges to expose voice, authentication materials, and associated device information; this is not a remote attack that requires no device access. The report states that Meta has released a hotfix, and uses this to discuss the protection risks posed by the concentration of privileges in AI assistants.