A single undocumented setting let any Mac app take over Meta's Muse agent

Installing Muse is a permissions exercise before it is anything else. The user authenticates the app to each service, then approves macOS prompts covering five classes of protected resource: disk writes, the microphone, the camera, location and calendars ^[6][1]. Apple spent years building those prompts to keep installed apps and terminal commands away from exactly those resources, and Wired's assessment is that Muse undoes the defaults ^[7].

The flaw sat underneath all of that. Meta let any locally installed app or executed code change a long list of undocumented Muse settings, whatever macOS permissions that code held, and most of the settings are dull, like dark mode ^[9]. One of them set the endpoint where dictation is transcribed, normally a server Meta runs. A process that repointed it at an attacker's server would receive the token that gives complete control of the Muse account ^[10]. The attacker needed only code running as the user ^[2].

"We can manipulate the agent and leverage its privileges to do whatever we want," said Patrick Wardle, the macOS security expert who found the flaw and spoke to Ars before the hotfix ^[11][13]. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself," he said ^[12].

The dictation choice made the difference, Wardle said: Muse transcribes in the cloud, where Meta can log it. macOS has long offered apps a way to transcribe on the device, and the safer path would have closed the attack ^[17]. Meta has published two posts in as many weeks documenting the design decisions behind the assistant's security and privacy ^[16].

Wired does not report Amazon's reason for the block ^[19]. Meta advertises Muse as able to make purchases, fill out forms and connect with a user's favourite apps and services ^[5].

For whoever has to approve this on managed Macs, two checks are worth more than a vendor security post. The first is whether, for every OS permission the agent requests, the platform offers an on-device path the vendor skipped, and what the vendor gained by skipping it; cloud transcription is the case in point here ^[17]. The second is whether the build's settings can be written from a shell with nothing granted. A shell with no permissions is how the Muse token leaked ^[9][10]. "To me, the bar is infinitely higher in terms of the security of these apps," Wardle said ^[20].