Meta Hotfixes Muse Mac Flaw That Let Local Malware Hijack Dictation

Meta has patched a flaw in its Muse AI assistant for Mac that let local malware redirect the app’s voice dictation and borrow whatever access users had granted the agent. Security researcher Patrick Wardle, co-founder of the nonprofit Objective-See, published a proof of concept called not-a-mused, and Meta shipped a hotfix within about a day.

The problem was an undocumented setting, endo_voyager_dictation_endpoint, that any process running as the user could change without special privileges, The Register reported. Point it at an attacker’s server, wait for the user to dictate a prompt, and the attacker could capture the audio and prompts, inject instructions and potentially steal authentication material. Wardle’s proof of concept implements a subset of the more than 50 commands Muse exposes. “Muse’s access can potentially become the attacker’s access,” the repo says.

Local, but amplified

The bug can’t be exploited remotely, since an attacker first needs code running on the Mac. Wardle’s concern is what happens next. Ordinary malware is boxed in by macOS privacy controls, but an AI agent that has been granted broad access becomes a shortcut around them. “Just because a bad neighbor moves in doesn’t mean that that neighbor automatically has access to all the apartments,” he told The Register. AI apps, he said, “basically could do anything on your computer” once they’re configured to be useful.

He also noted that Apple offers on-device dictation. Had Muse used it instead of sending dictation to Meta’s cloud, the vulnerability wouldn’t have existed.

David Singleton of Meta Superintelligence Labs played down the risk while confirming the fix. “This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low,” he wrote. “Nonetheless, we have issued a hotfix to the app to address the issue.” The fix removes the endpoint setting from production builds, and users should update to the latest version.

A rough first month

Meta had promoted Muse’s security at launch, including its Muse Secure VM design, and described its approach to prompt injection defenses and red teaming. The patch landed in the same week that Amazon blocked Muse from making purchases on its store, as The Verge reported, and a group of large banks published principles for AI shopping agents.