Berlin Bassline Brief #20: Musing on a Muse 0-day, Apple Intelligence Report, Who Owns Broken AI? Speculative Programmatic Tool Calling, Apple Reference Image

"Once in a golden hour I cast to earth a seed. Up there came a flower, The people said, a weed."

        September 23, 2026

Berlin Bassline Brief #20: Musing on a Muse 0-day, Apple Intelligence Report, Who Owns Broken AI? Speculative Programmatic Tool Calling, Apple Reference Image
Berlin Bassline Brief #20: Meta's Muse gets a nasty 0-day, plus Apple Intelligence report reads, AI accountability research, speculative tool calling, and Apple's verified photo images.

        "Once in a golden hour
I cast to earth a seed.
Up there came a flower,
The people said, a weed."

Welcome to late September! The days are getting shorter and the golden light oblique. Sweatah weathah is around the cornah!
Security, General:
Patrick Wardle found a 0-day in Meta's new Muse: https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/

Security, Apple Platforms:
"Read an Apple Intelligence Report" by Howard Oakley: https://eclecticlight.co/2026/09/22/read-an-apple-intelligence-report/
Interesting Paper:
"Who Owns AI When It Breaks? The Convergence of AI Governance and Cybersecurity Accountability" by Jess J. Montgomery and Joshua D. Copeland: https://careered.libguides.com/ctu/journal/thepinnacle/v4n2MontgomeryCopeland

Interesting Tool:
Speculative Programmatic Tool Calling, from Alex Zhang: https://github.com/alexzhang13/spec-ptc
Apple Platforms Security Concept of the Week:
Apple Reference Image: A New Approach for Verified Photography https://security.apple.com/blog/apple-reference-image/

The Berlin Bassline Brief is curated and commentated by Halle Winkler, CEH, Berlin – get in touch if you could use security consulting, fractional AppSec leadership, or team training in the area of iOS and macOS secure development.

Check out my course Breaking Into the Security Mindset, for engineers and engineering managers, to get to grips with the new application security landscape: https://www.driyourcareer.com/security

RSS

                                Don't miss what's next. Subscribe to The Berlin Bassline Brief:

                        Email
                        *

                    ← Newer

                Berlin Bassline Brief #21: OpenAI sued over Hugging Face but not by them, Apple RCE patched, epistemic trustworthiness better than moral, PHANTOM-B cards, restrict Apple Intelligence

                    Older →

                Berlin Bassline Brief #19: a strong opinion on the AI research question, Golden Gate release, moral imputability problems in current tech, new Apple VM tool, Background Security Improvements