Xadgudub Amniga oo ka jira Mashruuca Muse ee Meta: Faragalin buuxda oo loo sameeyay barnaamijyada macmiilka
Shirkadda Meta ayaa soo saartay Muse, barnaamij AI ah oo macmiilka u sameeya adeegyada kala duwan, laakiin xadgudub amniga oo la xaqiijiyay ayaa si weyn uga dhigay in la isticmaalo. Xadgudubkan ayaa u ogolaaday barnaamijyada macmiilka inay gacanta ku dhigaan barnaamijka Muse, iyadoo shirkadda Amazon ay ku joojisay isticmaalka Muse.
Xadgudubka iyo sida loo heli karo
Xadgudubka amniga ee Muse ayaa u ogolaaday barnaamijyada macmiilka inay beddelaan goobta ay ku dhacaan codka macmiilka, iyadoo ay ku xiran tahay inay gacanta ku dhigaan barnaamijka Muse. Xadgudubkan ayaa u ogolaaday barnaamijyada macmiilka inay gacanta ku dhigaan barnaamijka Muse, iyadoo ay ku xiran tahay inay gacanta ku dhigaan barnaamijka Muse.
Patrick Wardle, xirfadle amniga macOS, ayaa xaqiijiyay xadgudubkan, wuxuuna yiri, 'Waxaan u isticmaali karnaa barnaamijka Muse si aan u sameeyo wax walba oo aan rabo.' Wardle ayaa sidoo kale sheegay inuu sameeyay dhaqdhaqaaqyo amniga ah oo muujinaya inay ku xiran tahay inay gacanta ku dhigaan barnaamijka Muse.
Jawabta Meta iyo Amazon
Mark Zuckerberg, hoggaamiyaha Meta, ayaa sheegay in Muse uu 'sameeyay si buuxda u ammaan ah oo amniga leh.' Laakiin, Meta ayaa 12 saacadood ka dib xaqiijisay inay sameysay tixraac amniga ah oo xadgudubkan ka saaray. Meta ayaa sidoo kale sheegtay in xadgudubkan uu ahayn 'faragalin ka baxsan', laakiin waxaa jira dhaqdhaqaaqyo amniga ah oo muujinaya inay ku xiran tahay inay gacanta ku dhigaan barnaamijka Muse.
Amazon ayaa ku joojisay isticmaalka Muse, waxayna sheegtay in Muse uu yahay 'barnaamij AI ah oo aan la aqoonin oo ka horreeya shuruudaha Amazon.' Amazon ayaa sidoo kale sheegtay inay u baahan tahay inay gacanta ku dhigaan barnaamijka Muse, iyadoo ay ku xiran tahay inay gacanta ku dhigaan barnaamijka Muse.
Fiiro gaar ah oo loo yeeshay
Wardle ayaa sheegay inuu u baahan yahay inuu ka hadlo xadgudubkan iyo khataraha kale ee barnaamijyada AI-ka ah ee macmiilka. Wardle ayaa sidoo kale sheegay inuu u baahan yahay inuu ka hadlo xadgudubkan iyo khataraha kale ee barnaamijyada AI-ka ah ee macmiilka.
Meta ayaa sheegtay inay sameysay tixraac amniga ah oo xadgudubkan ka saaray, laakiin waxaa jira dhaqdhaqaaqyo amniga ah oo muujinaya inay ku xiran tahay inay gacanta ku dhigaan barnaamijka Muse. Wardle ayaa sidoo kale sheegay inuu u baahan yahay inuu ka hadlo xadgudubkan iyo khataraha kale ee barnaamijyada AI-ka ah ee macmiilka.
Meta introduced Muse, a macOS-based AI assistant capable of booking appointments, making purchases, and connecting to WhatsApp and email. However, a zero-day vulnerability discovered by security expert Patrick Wardle allows any locally installed app or terminal command to hijack the agent and gain full control over user accounts.
The Vulnerability and Its Impact
The zero-day flaw enables attackers to manipulate Muse's undocumented settings, including the endpoint where voice transcription occurs. By redirecting this endpoint to a malicious server, an attacker can intercept the authentication token that grants complete control over the user's Muse account.
Wardle demonstrated the exploit using a simple terminal command that sent a prompt to Meta's server, which incorrectly responded that such an action was impossible. He has also developed proof-of-concept attacks capable of writing malicious files to disk and capturing photos without the user's knowledge.
Amazon Blocks Muse and Meta Responds
On Sunday, Amazon began blocking Muse from its website, labeling it an 'unauthorized AI agent [that] violates Amazon's Conditions of Use.' Amazon stated that third-party applications making purchases on behalf of customers should operate openly and respect service provider decisions.
More than 12 hours after Wardle's disclosure, Meta released a hotfix to patch the vulnerability. In its statement, Meta claimed the flaw was 'not a remote exploit,' despite evidence that social engineering scams could achieve the same effect.
Security Expert Criticizes Meta's Approach
Wardle, a former NASA and NSA employee and creator of the Objective-See Foundation, criticized Meta's security posture, stating, 'To me, the bar is infinitely higher in terms of the security of these apps. They don't have to be perfect, but when you take a look at Muse, it's like they didn't, in my opinion, think about security, which is really worrisome.'
He noted that Meta's decision to use cloud-based transcription instead of macOS's built-in on-device option was a significant design flaw. Wardle plans to discuss the vulnerability and broader AI assistant threats at the Objective by the Sea security conference in November.
Ilaha iyo xuquuqda sawirka
Sawir: Wired Xigasho
