Meta Muse Mac setting lets malware hijack dictation

Malware already running on a Mac can quietly take over Meta Muse, the personal AI assistant Meta launched this month in the United States, and send a user's dictated prompts to an attacker instead of to Meta. Security researcher Patrick Wardle demonstrated exactly that in a proof of concept released on September 21. A proof of concept is a small working demonstration, built to prove that a flaw is real rather than to serve as a finished attack tool.

The weak point is in the Mac version of Muse, and it only works if an attacker can already run code as the logged-in user. On its own it cannot break into a Mac. What makes it serious is how much access Muse is meant to hold. Once someone turns Muse on, the assistant can work across that person's files, email, messages, calendar, shopping and smart-home apps, using whatever access the user chooses to grant it. Wardle's point is that this access is the prize: an attacker who can quietly steer Muse inherits everything the user allowed the assistant to do.

macOS, Apple's operating system for Mac computers, normally keeps one application away from another application's files, microphone, camera and saved logins, which limits what ordinary malware can reach. Wardle also warns that security software may not notice this attack, because the commands arrive from Muse, a normal signed app, rather than from something that looks like malware.

The mechanism he found is a single undocumented setting that decides where Muse sends dictation, meaning the words a user speaks so that software can turn them into text. It is stored in the Mac app's preferences under the name endo_voyager_dictation_endpoint, and any program running as the logged-in user can point it at an address the attacker controls, without needing any extra permissions. From that moment the dictation no longer goes to Meta. When the user speaks a prompt, both the audio and the text go to a small program the attacker is running on the same Mac.

Starting from that position, Wardle showed three things an attacker can do. The first is to read whatever the user dictated. The second is to add extra instructions that Muse trusts and then acts on. The third is to capture a token, which is the digital pass that keeps a person signed in to their Muse account, and then use that token to read the account's chat history and control the assistant directly.

Because a Muse account can be signed in on several devices at once, an attacker holding the token can give orders to Muse on any of them, not only on the Mac. Wardle used the access to direct the Muse app on his own iPhone to report its exact location, to run a Bluetooth scan of nearby devices, and to list the smart-home commands it was able to send. In his tests, the assistant only drafted messages rather than sending them on its own.

Wardle was also clear about what the attack does not do. It does not defeat the part of macOS that stops one app from reading another app's saved passwords and tokens. Muse sends its own token along with the redirected dictation, so the attack works by making Muse act with access it already had. Nor does it show that Meta's cloud system, which the company built to keep each user's agent walled off from the others, was broken.

The flaw is not only a local problem. Wardle told The Hacker News that a remote attacker could hijack Muse and steal its token through a ClickFix trick. ClickFix is a scam in which a website or a message fools the user into running a single command, typically pasted into Terminal, the Mac's text command tool, with nothing to download and nothing to install. That is why his public advice is blunt: do not install Muse, which he called trivial to turn into the ultimate backdoor.

Wardle said he did not report the flaw to Meta before going public. He chose full disclosure so that users would understand the risk, and because it is often the fastest way to get bugs of this kind fixed. He said Meta has since pushed out what he called a fix, pointing to a post on X. The Hacker News said it could not confirm what that change does and had reached out to Meta for comment. Meta has not published a security advisory.

Until Meta confirms a fix, Mac users can limit their exposure. Quit Muse, or remove it. Review the apps and permissions Muse holds and revoke any it does not need, so there is less for an attacker to reach. If the Mac may already be compromised, treat the Muse account and the accounts connected to it as exposed, and change their passwords. Because the attack needs the user to dictate, stay away from Muse's voice input, which closes the exact path Wardle demonstrated. And never run a command that a website or a message tells you to paste into Terminal, which is where a ClickFix attack begins.

Meta has invested heavily in Muse's security. The company built the agent to run in a separate cloud system that keeps each user's data apart from everyone else's, with a checking layer meant to approve the actions Muse takes. This flaw sits in the Mac app instead, not in that cloud design. Wardle argues that Meta created the weak point itself, by building its own way to handle dictation that sends the audio off the device, rather than using Apple's dictation, which runs on the Mac. He added that he has found further flaws in AI assistants, including in much more widely used apps, which he has reported to the vendors and plans to present at the Objective by the Sea conference in Hawaii in November.

For businesses that want help reviewing the access their software and staff are granted, AEU-I is the group's security-first IT, infrastructure and consulting service, and that is the kind of review worth doing before an assistant is given the run of a company's files, mail and calendars.