Imagine this: You’re in a meeting. You click a link in the chat. That’s it. In less than a second, someone halfway across the world has your entire Google account—emails, docs, calendar—and they can turn on your webcam without you ever knowing.
This isn’t a theoretical threat. It’s exactly what security researchers found in Granola, a popular AI-powered meeting assistant that thousands of professionals trust to take notes, record conversations, and manage their calendars.
And here’s the part that should keep you up at night: Granola is built on web technologies. It’s a desktop app that runs like a local application, but underneath it’s just a browser with superpowers—access to your microphone, your camera, your OAuth tokens, your entire machine.
You’ve probably spent years obsessing over browser security. You’ve installed ad-blockers, VPNs, and password managers. You’ve been trained to fear phishing emails and suspicious links. But none of that matters when the threat is already inside your trusted apps.
Here’s how the attack works: Granola uses a ‘navigation’ feature that lets you open links inside the app. It’s designed for convenience—one click to open a meeting note, one click to share a resource. But that same feature can be weaponized. A malicious link can hijack the app’s embedded browser, steal your session tokens, and—because the app has been granted full camera and microphone permissions—turn your laptop into a surveillance device.
Let me be blunt: This is not a bug. This is a design flaw baked into the architecture of ‘trusted’ local AI agents. The moment you give an app access to your hardware and your identity, you’re handing over the keys to the kingdom. And if that app is built on web tech, you’re also handing over the kingdom’s back door.
Strix, the researchers who uncovered this, reported it to Granola in early 2024. Granola fixed it quickly. But here’s the uncomfortable truth: every single desktop AI assistant that uses an embedded web view is vulnerable to the same attack. Not because they’re careless, but because the fundamental trade-off between convenience and security is broken.
We’ve been told that AI meeting assistants are the future of productivity. They’re smart, they’re helpful, they’re always on. But always on means always listening, always watching, and always exploitable. The next time you click ‘Allow’ on a permission request, ask yourself: Do I trust this app with my entire digital life? Because that’s what you’re doing.
And if you’re still not convinced, try this test: Open your browser’s developer tools on any desktop app built with Electron. Look at the security warnings. You’ll see a dozen. Now imagine that app has your webcam. That’s the reality we’re living in.
FAQ
Q: Is this vulnerability unique to Granola, or do other AI assistants have the same problem?
A: Granola patched it quickly, but the underlying architecture—a desktop app with an embedded web view and full OS permissions—is common to dozens of AI assistants like Otter, Fireflies, and others. The attack vector is universal.
Q: What should I do today to protect myself from this kind of attack?
A: Revoke unnecessary permissions. Don't give any app webcam, microphone, or file access unless you absolutely need it. And never click links inside a trusted app—open them in a separate browser instead.
Q: Isn't this just a standard browser-based attack that happens in every web app?
A: No. In a browser, the sandbox limits what a malicious link can do. In a desktop app with elevated permissions, the same link can access your hardware and local tokens. That's the difference between a minor annoyance and a total system compromise.