Build1 publisher2 min readPublished
Meta strips the debug key that let unprivileged scripts redirect Muse's dictation traffic
Patrick Wardle showed that one undocumented key, endo_voyager_dictation_endpoint, let unprivileged local code reroute Muse's dictation audio and account token. Meta stripped the key from production builds and requested no CVE.
The Engineer · Build desk
What happened
- Patrick Wardle, founder of the Objective-See Foundation, disclosed a zero-day in Meta's new macOS desktop client for Muse that lets locally running software or shell commands hijack the assistant.
- The flaw sits in an undocumented preference key, endo_voyager_dictation_endpoint, which any script running as the logged-in user can overwrite without admin rights and without an authorisation prompt.
- Wardle ran a proxy server that collected the raw microphone audio and the account authentication token the client sends on dictation, then passed the traffic on to Meta so the user saw nothing unusual.
- Meta shipped a hotfix that removed the internal debugging preference from production client builds, which stops local processes changing where dictation audio is sent.
- Meta handled the problem as an internal configuration defect and did not go through CVE assignment, so the flaw has no official identifier.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure The session token leaves the machine alongside the audio, so whoever captures it can drive the victim's Muse account from their own infrastructure without touching the Mac again.
- decision Endpoint teams have to decide whether an assistant client belongs in the privileged-software tier, with its preference domain watched for writes the way a launch agent is.
- precedent Treating a shipped client flaw as an internal config defect sets the expectation that agent-client fixes arrive as unlabelled build changes. Operators are left comparing version strings.
- contradiction Meta's position holds only if prior local code execution is costly; security professionals commenting on the disclosure put the cost at a phishing lure and note that TCC bypass is the part usually worth paying for.
A preference key on macOS is a value in an application's defaults domain, and anything running as that user can write one. Muse read the destination for its dictation traffic out of exactly that: an undocumented key, no elevated rights needed, no authorisation prompt on the way past. Under normal operation the value names the cloud server that receives voice audio and returns transcriptions, according to InfoQ. Change the string and the audio goes somewhere else.
Control of the endpoint also buys control of the command path. With a valid session token and the pipeline in hand, an attacker can append hidden instructions to voice requests and push the assistant into background work the user never asked for, including exfiltrating local documents or WhatsApp message histories. Wardle published a proof of concept called not-a-mused that runs numerous commands through the compromised agent.
The amplification comes from Apple's Transparency, Consent, and Control framework, which gates application access to hardware peripherals, files, address books and calendars. Muse acts across applications, calendars, email and files, so users routinely grant it broad system authorisations. Wardle's point is that an attacker can manipulate that agent instead of writing a standalone infostealer, turning a signed and trusted binary into the attack surface. A former Meta AI security engineering manager said they would avoid the software because of the risks of deep integration, InfoQ reported.
Zuckerberg had said the assistant was built from the ground up for privacy and security, and in the shipped client the address of the server receiving microphone audio came from a preference any unprivileged script could rewrite.
Singleton's framing is technically accurate, and it holds only if the first step is hard. Security professionals commenting on the disclosure argued that it is not: ClickFix-style lures make unprivileged local execution cheap, while bypassing TCC has traditionally been the expensive part of an attack. As a chain, the key removed the need for a TCC bypass.
Deleting the key from production builds closes this path. What would have to be true for it to close the class is that no other undocumented preference in that domain changes where data goes or what the agent trusts, and the disclosure covers one key. For anyone running a fleet, the practical consequence is inventory work: there is no advisory or CVE record to match a build against.
Amazon had already moved to block Muse from its shopping platform for non-compliance with its automated agent access policies. That was a server refusing an agent's traffic, while the preference key let a Mac grant an agent's traffic whatever the user granted the agent.
What to watch
- Whether Meta or a CNA later publishes an advisory and CVE for the flawed Muse builds, giving scanners something to match.
- Whether Wardle or others find other undocumented preference keys in the Muse domain that change endpoints or the agent's trust decisions.
- Whether more platforms follow Amazon in blocking Muse traffic under automated agent access policies.