Daily digest · 2026-09-22

Daily Digest, 2026-09-22

TL;DR: Meta's Muse assistant, which runs with wide privileges on a user's machine, has a serious zero-day, and Patrick Wardle separately showed that local malware can flip a hidden setting and receive the user's dictated prompts. A maximum-severity flaw in the MaxKB knowledge-base platform turns a poisoned prompt into commands running on the host. The pattern across today's research is the same: per-step permission checks pass while the whole sequence of tool calls goes past what was authorised, and injected instructions can sit dormant until a trigger fires. On the regulatory side, Spain's DPA fined Securitas Direct €100,000 for making people call a paid phone line to exercise their data rights, and a US federal agency was running Clearview AI face searches months before the paperwork that would have triggered privacy review.

Top stories

• Meta's Muse assistant has a zero-day that a ClickFix lure can trigger (Ars Technica, 2026-09-21). A plain social-engineering lure is one of several routes to full hijack of an assistant that acts with the user's privileges, so the flaw converts straight into exposure of that person's mail, files and accounts.
• Wardle: local malware can flip a hidden Meta Muse setting and receive the user's dictated prompts (The Hacker News, 2026-09-22). Malware already on a Mac changes one hidden setting and dictated prompts go to the attacker instead of Meta, along with the broad access the owner granted the app.
• MaxKB prompt injection lets attackers run OS commands on the host (GBHackers, 2026-09-22). CVE-2026-77521 carries a maximum CVSS score and affects versions up to 2.10.3-lts; a knowledge-base agent holding enterprise documents becomes the path to host command execution.
• Spanish DPA fines Securitas Direct €100,000 for routing rights requests to a paid phone line (EDPB, 2026-09-22). The AEPD treated friction in the rights-exercise path as an Article 12 violation, which sets the standard any AI product's access and deletion flows will be measured against.
• Clearview AI was already running at the Bureau of Indian Affairs before the sole-source award notice (Biometric Update, 2026-09-21). A federal agency ran face searches against a scraped biometric database months ahead of the procurement notice, with an Interior privacy assessment listing the use already operational.
• Per-call MCP authorization checks miss sequences that exceed the session's boundary (arXiv cs.CR, 2026-09-22). Every individual tool call can pass its local check while the whole sequence assembles a data set no approved call would have released, which is how tool-mediated exfiltration happens without one call looking wrong.

Also notable

• Explosive prompts hold the injected instruction until a trigger condition is met, conditional injection that defeats ingestion-time scanning.
• MCP SDK authentication and discovery reviewed against an agent that has already been injected, zero-trust authorization proposal for enterprise MCP.
• A backdoor in offline RL that only activates once the compliance-driven deletion runs, makes the erasure pipeline itself the trigger.
• Probe-geometry alignment pushes the memorization signature left by unlearning below chance, a probe to test whether a deletion request actually removed the record from the weights.
• Anonymised German resumes still leak demographics through LLM-generated text, EU AI Act high-risk hiring use where redaction does not hold.
• MIRAGE strips gait and silhouette from smart glasses video, then restores it only with consent, bystander de-identification beyond face blurring.
• Gartner: 41% of CISOs saw a deepfake on an employee audio call in the past year, baseline numbers for voice and video impersonation.
• Incident reporting frameworks were not written for agents, and this paper proposes changes, reporting thresholds and escalation paths for agent failures.

Beyond AI

• Meta appeals Ofcom's categorization of Instagram and WhatsApp under the Online Safety Act (Biometric Update, 2026-09-21). Meta served notice of appeal against the categorization that determines which extra duties each service carries. How the categorization survives decides which duties, including age assurance and recommender-system risk assessment, bind the platforms running the largest recommendation and moderation models in the UK.