Security1 publisher2 min readPublished
Any local process can rewrite the dictation endpoint in Meta's new Muse assistant
Patrick Wardle published working code that sends Muse's dictated audio to a server of the attacker's choosing. Because the assistant holds file, microphone, camera, calendar and paired-iPhone access, whoever redirects it inherits all of it.
The Watch · Security desk
What happened
- Patrick Wardle published proof-of-concept code for a zero-day he dubbed "not-a-mused" that turns Meta's new Muse AI assistant for Mac into a backdoor.
- The undocumented setting endo_voyager_dictation_endpoint can be changed by any local process at ordinary user privileges, sending dictated audio to a server the attacker controls.
- The accompanying code says the redirect allows captured prompts, prompt injection into the assistant, and theft of its authentication material.
- A follow-up post on September 21 showed a compromised session tasking a linked iOS Muse client for an iPhone's location, nearby Bluetooth devices, contacts, calendars and reminders.
- Wardle said he will release further detail and further bugs at the Objective by the Sea conference in November.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure One user-level foothold on a Mac now reaches a phone that was never itself compromised, so the scope of a macOS infection has to be drawn around the paired iOS device too.
- capability Post-exploitation code inherits microphone, camera, files, location and calendar access without asking for any of it, because the assistant already holds the permissions an intruder would otherwise have to win.
- contradiction Meta calls Sentinel the sole authority for network egress; Wardle's exploit sets the audio destination from an unprivileged process, and the two accounts of that control point conflict.
- decision No fix has been reported, so endpoint teams choose between blocking the installer and monitoring a configuration value whose name is public only because a researcher published it.
Exploitability turns on one precondition. Wardle said the proof of concept is a local attack, one that assumes an attacker can already run code on the machine as the user [7].
What it buys after that foothold is access Muse already holds. Muse asks for reach across files, microphone, camera, location and calendar [9]. Wardle argues the assistant is a disproportionately valuable target because something built to manage a Mac holds far broader access than typical malware would arrive with [8]. "Muse's access can potentially become the attacker's access," the exploit's documentation stated [10]. Mark Zuckerberg has promoted Muse as a personal agent that works around the clock on a user's behalf [15].
The trigger is mundane: the user clicks the microphone and dictates a prompt as they normally would [6]. The chain runs at the privileges the attacker already has, and the only thing the user approves is the dictation they meant to do anyway [17].
Meta said Muse uses isolated execution, least-privilege access, and a dedicated security layer called Sentinel, which the company described as the sole authority for connector actions and network egress [14]. The dictation destination is network egress, and Wardle's code sets it from an unprivileged local process [18]. iTnews did not report a Meta response to the disclosure.
The reach stops short in one place. Messaging, in Wardle's follow-up, only prepared a draft instead of sending silently [12].
No patch has been reported. What is left is the researcher's own advice. "Please don't install," he wrote. "It's trivial to turn Muse into the ultimate backdoor" [3]. Wardle founded the Objective-See Foundation and wrote The Art of Mac Malware, and he put the exploit on GitHub alongside the thread [2]. Fleets without Muse deployed have nothing here to remediate, since the exposure arrives with the installer.
This is the second time this year that a broadly entitled agent has drawn this kind of warning. OpenClaw, then called Clawdbot, prompted warnings from companies and security researchers over the risks of giving an AI agent broad access to a user's computer, files and accounts [16].
What to watch
- Whether Meta makes the dictation endpoint unwritable by local processes or routes it through Sentinel.
- Any Meta statement or CVE assignment for endo_voyager_dictation_endpoint.
- Whether commodity macOS stealers add the endpoint rewrite to their post-exploitation steps.