Meta built Muse to guard your personal data, provided nobody tells the app to hand the keys to someone else.
Muse was released on 8 September, promoting the AI assistant as a secure, privacy-first tool. Fast forward a couple of weeks, and security researcher Patrick Wardle published “not-a-mused”, a proof of concept exploiting an undocumented macOS setting. Awkward optics aside, the inner workings of the exploit show a more interesting technical problem.
To be clear, this isn’t a zero-click remote exploit. An attacker already needs code running on the victim’s Mac through malware, a shady download or a social engineering scheme like “ClickFix”. With that initial access secured, the vulnerability exposes broad capabilities.
Wardle found that an unprivileged process can rewrite a hidden setting called
endo_voyager_dictation_endpoint without requesting system permissions. That simple change then redirects Muse dictation traffic straight to an attacker’s server instead of Meta’s backend.
What An Attacker Gaining Access Can Actually Do
Once the endpoint redirects to a rogue server, an attacker can monitor spoken prompts, alter outgoing requests, inject new commands and capture authentication tokens.
Wardle demonstrated all four risks in practice, with token theft posing the main threat. Armed with a valid session token, an attacker can log directly into a user’s Muse profile, read past conversations and issue commands under their credentials, effectively impersonating the assistant the user thought they controlled.
Simply put, we’re looking at local privilege escalation and assistant hijacking as opposed to a magic remote exploit. The flaw can’t break into a clean Mac. It turns dangerous because Muse holds access to sensitive personal data and connected tools that the user has already approved.
More from News
- Digital Avatars Are Bringing Deceased Artists Back To The Stage – Where Do We Draw The Line?
- Can Europe Solve Its Critical Minerals Problem Fast Enough To Support Its Tech Ambitions?
- Google Has Agreed To A £260 Million Settlement: Who’s Eligible For Compensation?
- China Wants To Build A Third Global AI Bloc – What Does That Mean For Everyone?
- Advanced AI Society Joins the Linux Foundation And Launches Open Verification Ecosystem
- What Could Snap’s Partnerships With Big Tech Mean For The AR Industry?
- Why Did A Four-Year Bomb Threat Campaign Involving 500,000 Gmail Accounts Go Unchecked?
- What Do Dario Amodei And The JCHR’s AI Warnings Mean For Startups and SMEs?
Security Flaws Meet Explosive User Growth
The flaw came to light right as Muse was pulling in huge download numbers.
App tracking figures from Sensor Tower put the assistant past 2.5 million downloads in its first 13 days, with around 730,000 in the opening five days alone, eventually topping ChatGPT as the US iOS chart-leader on 18 September.
Separate market intelligence logged over 902,000 downloads across its first six days, noting it held the top spot on both the US App Store and Google Play on 21 September, the same day Wardle released his findings. Since these metrics come from analytics platforms instead of official Meta releases, they vary by tracking window and work best as industry estimates.
Meta built its launch campaign around user control and privacy, pointing to its dedicated Muse Secure VM as the backbone of the app’s setup. The friction comes from how a hidden, editable config file allowed background code to reroute dictation traffic without resistance.
This doesn’t mean Meta’s security approach broke down completely. Instead, it exposes a specific vulnerability: system-level protections falter when an AI assistant receives broad device access without properly isolating its internal settings from other local programs.
Why AI Agents Make This Kind Of Flaw Worse
Wardle’s main concern touches on more than just one misconfigured setting.
An AI assistant acts like a trusted master key for an entire computer. Normally, if a malicious file attempts to peek at private data, macOS steps in with a popup asking for explicit approval before granting entry.
However, because an AI assistant already holds permission to read files and messages, taking control of the assistant grants an attacker those same rights automatically. System security lets the intrusion straight through without raising an alarm because the computer assumes the trusted assistant is performing routine tasks.
Meta has yet to issue an official response, leaving details unconfirmed on patch status, token longevity or an internal severity rating. No formal CVE identifier has surfaced in public records, though security teams label the exploit a local zero-day.
The critical point comes back to product design. Its security boundary collapsed where the assistant offers the most convenience: Muse carried wide-ranging device access, leaving the door open for local code to hijack the controls and grab those rights for itself.
