👯

We appreciate this report and have issued a hotfix to the Muse Mac app. This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low. Nonetheless, we have issued a hotfix to the app to address the issue. We take every report of a possible security problem very seriously, including those that arrive as published exploit code (like this one). We strive to be extremely transparent about privacy and security in Muse as we know this is important to maintain your trust. Therefore, here’s a little more detail on this issue: - Muse's dictation is powered by a server-side speech model. The app shipped with an internal setting that allows the endpoint used by this feature to be redirected to a different URL, which is useful during debugging and development. - The setting lives in the app's local preferences, which macOS allows any program running under your user account to modify. Changing this requires malicious code already running on your Mac. This is not remotely exploitable, and it does not involve Muse's servers or the Secure VM that isolates agent tasks. - Overriding this setting would let an attacker proxy audio dictation requests and capture the access tokens the Muse app uses to drive the Muse agent – expanding malware already present on your computer into the Muse agent. Our hotfix removes the endpoint setting from production builds entirely, which closes this vulnerability. - We are grateful for the work of the security research community and potential security issues can be responsibly disclosed via our bug bounty program, which pays up to $300,000 for exactly this class of finding. bugbounty.meta.com/

The action button integration is absolutely the fastest way to ask your @Muse to do stuff for you on iOS - including directly from the lock screen. It's sick!

I've been using the @Muse app on my Mac all day, every day for a while. There are four things it does that I really love: 1/ Quick access to my Muse when I'm working in any other app: ⌥–Space and Octavian appears, ready to help. 2/ Fast SOTA dictation into any app on my computer by holding fn (these shortcuts are configurable, ofc). 3/ The Muse app works with the messaging apps on my computer and helps me keep up. Sorry if I ghosted you before; I can never keep on top of my messages. Muse is already making me a better texter. 4/ My Muse has a little bot status pill that hangs out in the corner and tells me what Octavian is up to on my behalf all day long. What are you using the Mac app for?

Having a personal avatar in @Muse was the very very first feature I fell in love with. The animations while working or when something great happens are 😍. Making these so consistently Muse while so charmingly unique was worth it, I think!

Hot off the presses: all @Muse users can ask their Muse to make an audio podcast episode on any topic.