智能体
arstechnica.com ·
@Dan Goodin
Meta 高权限 AI 助手 Muse 存在严重 0-day 漏洞
Ars Technica 报道称，Meta 权限极高的 AI 助手 Muse 存在一个严重 0-day，简单的 ClickFix 攻击即可完全劫持该 agent。摘要未披露漏洞技术细节、影响范围与 Meta 回应。
AI推荐理由 Ars Technica 报道 Meta 高权限 AI 助手 Muse 存在严重 0-day，摘要指出 ClickFix 攻击可完全劫持该 agent。这是关于个人 agent 安全边界的可验证安全事件，对 agent 权限模型设计有直接参考价值；但正文片段仅给出攻击类型，未提供漏洞细节、影响范围或厂商回应，需保留不确定性。
82
正文
Domain: arstechnica.com
Points: 27 | Comments: 7
[Top Comments]
- Who in their right mind would install a Meta AI with near admin privileges?
- We all fear the true answer to that question.
- almost every normal person
- I'm confused what the vulnerability is. Does macOS have some specific function for protecting key material, that it's unexpected that if you execute user-privileged code locally, outside of a sandbox, it gets full read access?
- Yeah macOS security is capability based rather than purely identity based. So if you don't pass the required entitlements to an application then it cannot do stuff like read from the system keychain even if its running as your user.
- A zero day? Of course it does. It likely has many. Given the history of software, it's impossible to think it wouldn't.