Meta's AI assistant Muse has a serious 0-day that lets local apps steal account tokens

Meta AI 助手 Muse 曝出严重 0-day，可被本地应用窃取账户令牌

A serious 0-day in Meta's AI assistant Muse allows attackers to fully hijack the agent and steal account tokens via a ClickFix attack. CEO Zuckerberg had touted Muse as 'built from the ground up for privacy and security.' The post does not disclose whether the vulnerability has been patched or the scope of affected users.