"Trivial to turn Muse into the ultimate backdoor," security researcher Patrick Wardle warned after publishing a proof‑of‑concept on September 21 that shows how malware already running on a Mac can quietly take over Meta's Muse assistant.
Patrick Wardle's proof‑of‑concept and the constraints of the attack
Wardle's demonstration, released on September 21, targets the Mac version of Muse and requires that an attacker already be able to run code as the logged‑in user. It is not a remote exploit that breaks into a Mac from the internet; instead, it leverages an existing local compromise to change how Muse handles voice dictation. Muse, Meta's personal AI agent launched this month in the United States, can work across files, email, messages, calendar, shopping and smart‑home apps based on the permissions a user grants.
The undocumented preference: endo_voyager_dictation_endpoint
The key technical detail Wardle found is an undocumented Mac app preference named endo_voyager_dictation_endpoint. Stored in Muse's preferences, this setting decides where Muse sends dictation. Any program running as the logged‑in user can modify that value and point dictation at an address controlled by an attacker without requiring additional macOS permissions.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the redirected dictation turns Muse into a conduit
Once the preference is changed, spoken prompts no longer go to Meta. Instead, the audio and transcribed text are routed to a small program the attacker runs on the same Mac. Wardle showed three concrete things an attacker can then do: read what the user dictated; inject extra instructions that Muse will trust and act on; and steal the token that identifies the user's Muse session to control the assistant directly.
Wardle also cautioned that this kind of misuse may evade detection by security software because the commands appear to come from Muse itself — a normal, signed application — rather than from an obvious piece of malware. He framed the risk against macOS's usual inter‑app protections, noting that while macOS normally prevents one app from reading another app's files, microphone, camera or saved logins, quietly steering Muse gives an attacker whatever access the user has already allowed Muse to hold.
Cross‑device reach: a stolen session can control Muse elsewhere
Because a Muse account can be signed in on multiple devices, the compromise need not stop at the Mac. Using a stolen session token, Wardle directed the Muse app on his iPhone to report its exact location, run a Bluetooth scan of nearby devices, and list smart‑home commands it could send. In his tests the assistant drafted messages rather than sending them on its own, but the actions demonstrate how a local change on a Mac can enable reconnaissance and control across a user's connected devices.
What Mac users can do now
- Quit Muse, or remove it, until Meta issues a fix.
- Review the apps and permissions Muse holds and revoke any it does not need to reduce the attack surface.
- If a Mac may already be compromised, treat connected accounts as exposed and change their passwords.
- Avoid Muse's voice input — the attack requires the user to dictate, and avoiding dictation closes the exact path Wardle demonstrated.
Wardle also argued that the vulnerability stems from Meta's choice to build its own dictation path that sends audio off the device rather than using Apple's dictation, which runs on the Mac. Meta, the source notes, placed significant emphasis on Muse's security by running agents in a separate cloud system designed to keep each user's data walled off and by adding a checking layer for actions; the flaw Wardle found sits in the Mac client rather than in that cloud design.
Wardle's findings leave a narrow but serious chain of risk: an attacker needs local code‑execution as the logged‑in user, but once that precondition is met the researcher shows it is straightforward to repurpose Muse's granted privileges into a broader foothold. Until Meta issues a patch, the clearest mitigations are to remove the local attack surface and treat connected accounts as potentially exposed.
