A summary of today’s most newsworthy AI-related cybersecurity and privacy developments.
1. Meta’s “Muse” AI Assistant Could Be Hijacked to Act on an Attacker’s Behalf
Security researcher Patrick Wardle disclosed a zero-day flaw in Meta’s Muse, a personal AI assistant with reach into a user’s email, calendar, WhatsApp, and social accounts. Any locally running program or terminal command could quietly redirect one of Muse’s undocumented settings, letting an attacker steal the token that authenticates the user’s Muse session and take over the assistant’s privileges. Wardle demonstrated the flaw by getting Muse to write malicious files and take photos via the webcam, in some cases with no visible warning to the user; Meta has issued a hotfix for the Mac app.
Risk: Any organization whose staff use always-on AI assistants with broad account access faces a new class of attack where compromising the assistant, not the underlying accounts, is enough to hand an attacker the assistant’s full reach — email, calendar, payments, and files included.
2. AWS’s Agent Platform Leaks “Encrypted” Credentials in Plain Text
Palo Alto Networks’ Unit 42 showed that AI agents built on Amazon’s AgentCore platform can be tricked, via a single poisoned support ticket, into leaking credentials that AWS advertises as protected by an encrypted vault. Because the agent’s shell tool runs with unrestricted access to the same memory where secrets are briefly decrypted for use, a prompt-injection attack triggered the agent to run a “diagnostic” script that exfiltrated a master authentication token to an outside server. AWS says it reviewed the finding and closed it as informative, placing the responsibility on customers to restrict agent tool access.
Risk: Organizations deploying AWS’s default agent configuration may be exposing master credentials to any attacker who can slip instructions into content the agent processes — a common entry point for support desks, ticketing systems, and other agent-facing workflows.
3. Cisco Talos Releases Toolkit to Track Malware That Consults AI Models for Its Next Move
Cisco Talos launched CAIRN, an open-source toolkit that hunts for malware built around AI components by scanning for traces like API endpoints, agent-style tool-call syntax, and jailbreak language, without running the suspect code. Alongside the release, Talos detailed CLOSEDQUORUM, the first documented Windows implant designed to poll up to four commercial AI models — DeepSeek, Qwen, Mistral, and Gemini — and vote on its next malicious action, from credential theft to process injection. The sample is not confirmed to be active in the wild, but the underlying decision-making architecture is real and functional.
Risk: As malware developers experiment with offloading tactical decisions to AI models, traditional detection based on hardcoded command-and-control infrastructure becomes less reliable, pushing defenders toward behavior- and metadata-based hunting well before this technique becomes widespread.
Sources: Cybernews, Cisco Talos / Cyber Security News. Compiled September 22, 2026.