Unpatched Vulnerability Found in Meta's macOS App

Security researcher Patrick Wardle has disclosed an unpatched zero-day vulnerability in Meta's macOS desktop app "Muse." If this vulnerability is exploited, unprivileged general software can illegitimately manipulate the extensive permissions that Muse possesses. As a result, eavesdropping on user input and unauthorized account access become possible.

A zero-day vulnerability refers to a defect that the developer has not yet identified or for which a patch has not been provided. In particular, desktop applications often possess access permissions to many system functions such as cameras, microphones, and keyboard input, and when such permissions are misused, the scope of damage tends to expand. AI assistant applications require such deep permissions, putting their security design under particular scrutiny.

According to Wardle's report, one of the debug settings included in the Muse app was left in a state where it could enable an operational mode that should originally be limited to development and testing purposes even in normal environments. This setting functioned as a loophole through which unprivileged external software could manipulate the app's behavior, potentially leading to theft of user input and compromise of account security. While macOS has built-in security mechanisms like sandboxing, this problem reportedly circumvents such security boundaries.

Meta provided a hotfix (emergency patch) in response to this report, but Wardle points out that the vulnerability has not been completely resolved. This means there is a possibility that risk remains at present. A hotfix is merely an emergency measure, and addressing the root cause may require additional patches.

What this issue highlights is the importance of security design in AI assistant applications. An AI client that operates based on user trust carries the risk of undermining platform security, which forms the foundation of that trust. If debug settings used during development were left in the production environment, this becomes an incident that raises questions about the entire software development process management system.

AI applications are likely to see expanded system access permissions as features are developed further. Correspondingly, vulnerabilities in the application itself become a viable entry point for attackers, increasing risk. How developers conduct security verification—at which stage and to what depth—is likely to become increasingly emphasized from a user protection perspective. Going forward, along with Meta providing a complete fix, industry-wide inspection to ensure that similar AI client applications do not have comparable issues will be required.