A setting nobody documented
A security researcher published working exploit code on Monday for Meta’s Muse assistant on macOS, and advised Mac users not to install the app. Patrick Wardle, who founded the Objective-See Foundation and writes about Mac malware, calls the proof of concept not-a-mused.
The flaw is an undocumented setting in the Muse macOS client named endo_voyager_dictation_endpoint. Any process running as the user can change it, with no administrator rights, The Register reported. Change it, and the audio a person dictates to Muse goes to an attacker’s server instead of Meta’s.
What that hands an attacker
Three things: the dictated audio and every prompt in it, the ability to inject instructions into the assistant, and the assistant’s authentication material.
The third is the serious one. Runtime Wire reports that Wardle’s code goes on to query Muse’s own device inventory API, works out which of the user’s devices are online, and issues commands to them. Muse exposes more than fifty. His demonstration retrieves an iPhone’s location remotely and runs Bluetooth scans on a paired phone.
Local, and that is the point
This is not a remote attack. It assumes something is already running code on the Mac as the user, which makes it privilege escalation rather than a way in. Wardle’s argument is that an assistant is exactly where that distinction stops holding.
Malware that lands on a Mac normally arrives with whatever permissions it can win for itself. Muse, to do its job, asks for files, microphone, camera, location and calendar. Anything that hijacks it inherits all of that at once, and the phone in the user’s pocket with it. An AI app, Wardle told The Register, “basically could do anything on your computer”.
Meta’s position
Meta promoted a feature it calls Muse Secure VM when the Mac client shipped, saying users control what the assistant can reach. The company did not immediately respond to The Register’s request for comment, and no patch has been announced. Runtime Wire reports that Meta is paying up to $300,000 for qualifying reports through a bug bounty on the assistant.
A two-week-old product
Muse is new. Meta introduced it on 8 September as an agent that acts across a person’s connected services — mail, calendar, payments, shopping — and it reached the top of Apple’s free US App Store chart within a week. The Mac client at issue here shipped on 17 September. Amazon blocked the agent from its store on Sunday, citing, among other things, how it handles credentials.
What to watch
Whether Meta makes the dictation endpoint a privileged setting, and how quickly. The larger question the disclosure puts on the table is which processes on a machine should be allowed to talk to an agent that can already talk to everything else.
