Meta Muse macOS

Meta's Muse assistant has a problem on macOS, a security researcher found a way for malware to quietly take it over, and the flaw wasn't reported to Meta before going public.

Patrick Wardle published a proof-of-concept on September 21, he's a well-known macOS security researcher, and his finding is simple but serious, malware already running on a Mac can change a hidden setting, then every time you tap the microphone and dictate a prompt, your words go to the attacker instead of Meta.

The flaw is in the Mac version of Muse, and it only works if an attacker can already run code as the logged-in user, so it can't break into a Mac on its own, but Wardle told The Hacker News that a remote attacker could hijack Muse and steal its token through a ClickFix trick, where the user is fooled into running a single command, no download, no install, just paste and run.

Let me break down what he found.

Quick Summary

What Is Muse?

Muse is Meta's personal AI agent, it launched this month in the United States, and once you turn it on, it can work across your files, email, messages, calendar, shopping, and smart-home apps, using whatever access you choose to give it.

That access is the whole point, Wardle says, and that's what makes the flaw dangerous.

"Trivial to turn Muse into the ultimate backdoor," he said, and he urged people not to install it.

Why macOS Normally Protects You

macOS has strong app isolation, so one app can't just read another app's files, microphone, camera, or saved logins, which is why ordinary malware is limited in what it can do.

But if an attacker can quietly steer Muse, they get everything the user allowed Muse to do, which bypasses the app isolation model without actually breaking it.

Wardle also warns that security software may not notice, because the commands come from Muse, a normal signed app, not from something that looks like malware.

The Hidden Setting

The setting Wardle found is undocumented, it decides where Muse sends dictation, and it's stored in the Mac app's preferences under the name endo_voyager_dictation_endpoint.

Any program running as the logged-in user can point it at an address the attacker controls, without needing extra permissions.

After that, dictation no longer goes to Meta, so when the user speaks a prompt, the audio and text go to a small program the attacker is running on the same Mac.

What an Attacker Can Do

Wardle showed three things.

1. Read what the user dictated, so every voice prompt goes to the attacker.
2. Add extra instructions that Muse trusts and acts on.
3. Capture a token that signs in to the user's Muse account, then use it to read chat history and control the assistant directly.

Because a Muse account can be signed in on multiple devices, an attacker with the token can give orders to Muse on any of them, not just the Mac.

Wardle used it to direct the Muse app on his own iPhone to report its exact location, run a Bluetooth scan of nearby devices, and list the smart-home commands it could send, though in his tests, the assistant only drafted messages rather than sending them on its own.

What the Attack Doesn't Do

Wardle was clear about the limits.

• It does not defeat the part of macOS that stops one app from reading another app's saved passwords and tokens, because Muse sends its token along with the redirected dictation, and the attack works by getting Muse to act with access it already has.
• It also does not show that Meta's cloud system was broken, since Meta built Muse to run in a separate cloud system that keeps each user's data apart, with a checking layer meant to approve the actions Muse takes, and this flaw sits in the Mac app, not in that cloud design.

The Disclosure Decision

Wardle did not report the flaw to Meta before going public, he chose full disclosure so users would understand the risk, and he also said it's often the fastest way to get such bugs fixed.

He said Meta has since pushed out what he called a "fix," pointing to a post on X, though The Hacker News could not confirm what the change does and has reached out to Meta for comment, and Meta has not published a security advisory.

What Mac Users Can Do Now

Until Meta confirms a fix, here's how to limit exposure.

• Quit Muse, or remove it.
• Review the apps and permissions Muse holds, and revoke any it doesn't need, so there's less for an attacker to reach.
• If your Mac may already be compromised, treat the Muse account and connected accounts as exposed, and change their passwords.
• Avoid Muse's voice input, because the attack needs you to dictate, so skipping voice closes the exact path shown.
• Don't run commands a website or message tells you to paste into Terminal, which is how a ClickFix attack starts.

The Bigger Picture

Meta put a lot of weight on Muse's security, it built the agent to run in a separate cloud system that keeps each user's data apart, with a checking layer meant to approve actions.

Wardle argues Meta created the weak point itself, because it built its own way to handle dictation that sends audio off the device, rather than using Apple's dictation, which runs on the Mac.

He said he has found more flaws in AI assistants, including in much more widely used apps, which he reported to the vendors, and he plans to present them at the Objective by the Sea conference in Hawaii in November.

The Bottom Line

A macOS flaw in Meta's Muse lets malware redirect dictation and steal account tokens, it requires existing code execution, so it can't break in on its own, but if an attacker gets that foothold, they can control Muse across devices, Wardle didn't report it before going public, Meta pushed a "fix" but no advisory, and if you use Muse, quit it or remove it, review permissions, change passwords, and avoid voice input.

Quick Reference

What to Do

• Quit or remove Muse
• Review and revoke permissions
• Change Muse and connected passwords
• Avoid voice input
• Don't paste Terminal commands from websites

FAQ Section

What is the Meta Muse macOS flaw?

A flaw in the Mac version of Meta's Muse assistant, where malware already running on a Mac can change a hidden setting to redirect dictation to an attacker.

How does the attack work?

The attacker changes endo_voyager_dictation_endpoint to point at their own server, then every dictated prompt goes to them instead of Meta.

What can an attacker do with it?

Read dictated prompts, inject instructions Muse trusts, and steal a token that signs in to the Muse account, which can then control Muse across devices.

Does the attacker need to break into the Mac first?

Yes, they need to run code as the logged-in user, so it can't break in on its own, but ClickFix can trick users into running that code.

What should I do if I use Muse?

Quit it or remove it, review permissions, change passwords, avoid voice input, and don't paste Terminal commands from websites.

Source: The Hacker News