Meta's Muse AI Assistant on Mac Contains Undocumented Setting That Lets Local Malware ...

A security researcher has demonstrated that malware already running on a Mac can silently take control of Meta's Muse assistant by flipping a single hidden setting, redirecting a user's dictated voice prompts to an attacker-controlled server instead of Meta's systems.

The flaw, disclosed September 21 by Patrick Wardle, founder of the Objective-See Foundation, affects the macOS version of Muse and requires that an attacker already be able to execute code as the logged-in user. It is not a remote code execution vulnerability. But once exploited, it grants an attacker the ability to read what a user dictates, inject additional instructions that Muse will trust and execute, and steal the session token that authenticates the user's Muse account.

Wardle described the attack as "trivial to turn Muse into the ultimate backdoor" and urged users not to install the assistant until Meta addresses the issue. Meta representatives did not respond to emailed questions from multiple outlets.

The vulnerability centers on an undocumented preference stored in the Mac app's configuration under the name endo_voyager_dictation_endpoint. Any process running as the logged-in user can modify this value without requiring elevated permissions, pointing dictation traffic to an address controlled by the attacker. From that point forward, when a user taps the microphone and speaks a prompt, the audio and transcribed text flow to the attacker's server rather than to Meta.

From that position, Wardle demonstrated three distinct capabilities. First, the attacker can read everything the user dictates. Second, the attacker can append additional instructions to the prompt, which Muse treats as legitimate and acts upon. Third, the attacker captures the token identifying the user's Muse session, enabling direct control of the assistant.

Because Muse accounts can be signed in on multiple devices, the compromise extends beyond the Mac. Using a stolen session token, Wardle directed the Muse app on his own iPhone to report its precise location, run a Bluetooth scan of nearby devices, and enumerate the smart- commands it could issue. In his tests, the assistant only drafted messages rather than sending them autonomously.

What the Attack Does Not Do

Wardle was careful to delineate the boundaries of the vulnerability. It does not defeat the macOS component that prevents one app from reading another app's saved passwords. Rather than stealing Muse's stored login credentials, the attack makes Muse itself act, leveraging the access the user has already granted the assistant. It also does not indicate that Meta's cloud infrastructure, which the company built to isolate each user's agent, was breached. The flaw resides entirely in the Mac application.

macOS normally prevents one application from accessing another app's files, microphone, camera, or saved logins through its Transparency, Consent, and Control framework. Ordinary malware is therefore constrained in what it can touch. An attacker who can quietly steer Muse, by contrast, inherits everything the user permitted the assistant to do—writing files to disk, accessing the microphone and camera, monitoring location, and interacting with connected accounts including WhatsApp, email, and calendars.

Wardle also cautioned that endpoint detection and response software may fail to flag the activity because the commands originate from Muse, a properly signed application, rather than from anything resembling malware. Security tools cannot easily distinguish whether a command is coming from the user, the agent, or an attacker.

Design Decisions Under Scrutiny

Meta founder and CEO Mark Zuckerberg has Muse as "built from the ground up for privacy and security." The company published two posts in as many weeks detailing the design architecture intended to keep an assistant with such expansive access secure, including a separate cloud system that isolates each user's data and a checking layer meant to approve actions Muse takes.

Wardle argues the vulnerability stems from two specific engineering choices. The first is Meta's decision to handle dictation in the cloud rather than using Apple's on-device dictation API, which processes speech locally on the Mac. Had Meta adopted Apple's approach, the attack would not have been possible. Wardle suggested the choice to route audio to Meta's servers was likely driven by a desire to access that data.

The second flawed decision, he said, is allowing any locally installed app or executed code to modify a long list of undocumented settings regardless of its macOS permissions. While most of those settings are innocuous—controlling dark mode, for instance—the dictation endpoint is anything but. The design raises questions how much effort went into security testing for an assistant that demands such broad access.

"To me, the bar is infinitely higher in terms of the security of these apps," Wardle said. "They don't have to be perfect, but when you take a look at Muse, it's like they didn't, in my opinion, think security, which is really worrisome."

He added that AI companies possess powerful models capable of finding bugs and questioned whether Meta was running them against its own applications. "You know these AI companies have really great AI models for finding bugs," he said. "Are they not running them against their own apps? Is the priority not the security of their own apps?"

Roughly 12 hours before Wardle disclosed the zero-day, Amazon began blocking Muse from shopping on its site. Users who attempted to use the assistant on Amazon received a message stating that Muse was an "unauthorized AI agent that violates Amazon's Conditions of Use."

Amazon said in an emailed statement that third-party applications offering to make purchases on behalf of customers should operate openly and respect service provider decisions participation. "This helps ensure a safe, secure, and reliable customer experience," the company said, adding that it had requested Meta remove Amazon from the Muse experience.

What Mac Users Can Do

With no patch available, Wardle outlined several steps Mac users can take to limit their exposure:

Note: These mitigations are temporary measures pending a fix from Meta. The vulnerability requires local code execution, so users who have not experienced a prior compromise face lower immediate risk.

Wardle said he plans to the vulnerability in greater detail, along with other threats posed by AI assistants, at the Objective by the Sea security conference in November. He is the author of "The Art of Mac Malware" book series and a former employee of NASA and the National Security Agency.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.