Meta's Muse assistant shipped with a local zero-day
Meta spent the Muse launch arguing that a personal agent can be convenient and safe at the same time. A macOS security researcher has now shown how much of that promise rested on the word "can."
A local zero-day in Meta's Muse macOS app lets an unprivileged process hijack the assistant's dictation traffic — and everything Muse is allowed to touch. Patrick Wardle, founder of the macOS security nonprofit Objective-See, published a proof-of-concept he calls not-a-mused, showing that Muse ships with an undocumented setting, endo_voyager_dictation_endpoint, that any code running locally can repoint without special privileges. Redirect that endpoint and the dictated audio — plus the prompts riding along with it — flows to an attacker's server instead of Meta's. From there Wardle describes prompt injection, theft of authentication material, and abuse of whatever accounts the user has already wired into Muse.
The bug is not remotely exploitable. It needs local code execution first, which is exactly why it matters. On macOS, Apple's Transparency, Consent, and Control framework and privilege separation are supposed to keep an ordinary malicious process boxed in — Muse requests file writes, microphone, camera, calendar, and location access, so a foothold inside the assistant is worth far more than a foothold next to it. Wardle calls it a privilege escalation, and notes a cheap ClickFix-style lure that gets a user to paste one command is enough to start the chain.
"We can manipulate the agent and leverage its privileges to do whatever we want," Wardle told Ars Technica. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." He said he has working proof-of-concept attacks that write malicious files to disk and take photos, in many cases with no visible signal to an alert user. Meta did not answer Ars Technica's questions and did not immediately respond to The Register.
Wardle singles out one design decision above the others: Muse handles dictation in the cloud, where Meta can log it. Apple has offered on-device dictation and transcription APIs for years; had Meta used them, a redirected endpoint would have had nothing worth stealing. His reading is that the data was the point. That framing is a straight rebuke to the launch pitch — Meta ships Muse: a consumer agent inside a sealed VM — where the Secure VM was offered as the answer to precisely this question.
It lands as more than a bug because of the timing. Roughly 12 hours before Wardle went public, Amazon began blocking Muse from shopping on its site, on the argument that no merchant consented to the agent acting there — Amazon bars Meta's Muse agent from shopping its site. Same week, same app, same underlying problem from two directions: an agent that holds your credentials and your permissions is a target with a very large blast radius, and nobody downstream gets a vote.
The security industry's answer so far is endpoint detection, and Wardle's point is that it cannot resolve the question that matters — whether a command came from the user, the agent, or an attacker. That ambiguity is structural, not a gap in the tooling. The honest version of the agent pitch is that convenience and access are the same dial, and every turn toward usefulness raises the ceiling on what a single mistake can cost.
What to watch: whether Meta removes the configurable endpoint or moves Muse dictation on-device, and whether Apple starts treating broad agent permissions as a platform problem rather than a per-app prompt.
Should an app that asks for your mic, camera, calendar, and files have to prove it cannot be turned against you? Tell us in the comments.
Sources: Objective-See: not-a-mused (GitHub)
