Amazon blocked Meta's Muse AI assistant from shopping on Amazon.com, citing lack of consent, undisclosed access, and security risks including credential capture. The move escalates a broader conflict between tech giants over AI agents' access to e-commerce platforms, with Amazon previously suing Perplexity and targeting agents from Google and OpenAI.
A zero-day vulnerability in Meta's Muse allows local attackers to redirect dictation traffic by modifying an undocumented endpoint setting, enabling capture of audio, prompt injection, theft of authentication credentials, and abuse of Muse's elevated access privileges. A proof-of-concept tool demonstrates the attack by intercepting dictated prompts sent to an attacker-controlled endpoint.
Meta's Muse is a new AI agent app that automates personal tasks like booking reservations and managing emails, downloaded over 900,000 times in its first week. While the tool effectively browses the web and completes tasks, the author finds it primarily focused on collecting user data through persistent prompts to connect email, banking, and other personal information sources.
A security researcher obtained 6.8GB of Muse's internal filesystem files through the iOS app and discovered internal tools including a CLI repair agent called Hatch, documentation of 68 integrations, and details about an experimental ESP32 smart-home device called Meta Home Link. The researcher reported findings to Meta's bug bounty program but was told they didn't qualify.
Meta's new AI assistant Muse, marketed as secure and privacy-focused, contains a critical zero-day vulnerability allowing any locally installed app or terminal command to gain full control of user accounts by intercepting authentication tokens. The flaw exploits a setting that redirects transcription to attacker-controlled servers, undermining macOS security protections.
Amazon has blocked Meta's Muse AI assistant from shopping on Amazon.com, citing lack of authorization and security concerns over credential handling. The dispute highlights broader tensions between tech giants over AI agents' access to e-commerce platforms, with Amazon pursuing legal and contractual remedies after previous lawsuits against other shopping agents failed.
Meta's Muse is a new AI assistant app that automates personal tasks like booking reservations and managing emails, downloaded over 900,000 times in its first week. While the tool effectively browses the web and completes tasks, the author found it more focused on collecting user data through memory storage and constant requests to connect additional information sources like email and bank accounts.
Meta reclaimed the @Muse social media handles across Facebook, Instagram, Twitter, and TikTok to launch its new AI agent named Muse, forcing the band Muse to rebrand as @Museband on these platforms.