Malware already running on a Mac can quietly take over Meta’s Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21.
It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta.
The flaw is in the Mac version of Muse, and it only works if an attacker can already run code as the logged-in user. It is not a way to remotely break into a Mac.
Muse is the personal AI agent Meta launched this month in the United States. Once a user turns it on, it can work across their files, email, messages, calendar, shopping and smart-home apps, using whatever access the person chooses to give it.
That access is the point, Wardle says. He urged people not to install Muse, calling it “trivial to turn Muse into the ultimate backdoor.”
macOS normally prevents one app from accessing another app’s files, microphone, camera, or saved logins, so ordinary malware is limited in what it can access. An attacker who can quietly steer Muse instead gets everything the user allowed the app to do.
Wardle also warns that security software may not notice, because the commands come from Muse, a normal signed app, rather than from something that looks like malware.
The setting he found is undocumented and decides where Muse sends dictation. It is stored in the Mac app’s preferences under the name endo_voyager_dictation_endpoint, and any program running as the logged-in user can point it at an address the attacker controls, without needing extra permissions.
After that, the dictation no longer goes to Meta. When the user speaks a prompt, the audio and the text go to a small program the attacker is running on the same Mac.
From there, Wardle showed three things an attacker can do: read what the user dictated, add extra instructions that Muse trusts and acts on, and take the token that identifies the user’s Muse session and use it to control the assistant directly.
Because a Muse account can be signed in on multiple devices, the attack does not stop at the Mac. Using a stolen session, Wardle directed the Muse app on his own iPhone to report its exact location, run a Bluetooth scan of nearby devices, and list the smart-home commands it could send. In his tests, the assistant only drafted messages rather than sending them on its own.
Wardle also pointed to what the attack does not do. It does not defeat the part of macOS that stops one app from reading another app’s saved passwords. Instead of stealing Muse’s stored login tokens, it makes Muse itself act, using access the app already has. And it does not show that Meta’s cloud system, which the company built to keep each user’s agent walled off, was broken.
What Mac Users Can Do Now
With no patch available, a Mac user can only limit the exposure:
- Quit Muse, or remove it, until Meta fixes the problem.
- Review the apps and permissions Muse holds, and revoke any it does not need, so there is less for an attacker to access.
- If the Mac may already be compromised, treat the connected accounts as exposed and change their passwords.
- Because the attack needs the user to dictate, avoid Muse’s voice input, which closes the exact path shown.
Meta has put a lot of weight on Muse’s security. It built the agent to run in a separate cloud system that keeps each user’s data apart from others, with a checking layer meant to approve the actions Muse takes. This flaw sits in the Mac app instead, not in that cloud design.
Wardle argues Meta created the weak point itself by building its own way to handle dictation that sends the audio off the device, rather than using Apple’s dictation, which runs on the Mac.
