A Mac Flaw Lets Any App Redirect What You Dictate to Meta's Assistant

Patrick Wardle, who founded the Objective-See Foundation and wrote The Art of Mac Malware, disclosed a flaw on Monday in Meta’s newly shipped Muse assistant for Mac. The problem is a setting called endo_voyager_dictation_endpoint, which is undocumented and which any locally installed app or terminal command can change without needing elevated privileges or passing the usual macOS permission prompts. That setting controls where dictated audio goes. Point it somewhere else and the words a user speaks to Muse are delivered to an attacker’s server instead of Meta’s, which also opens the door to injecting instructions back into the assistant and to stealing the token that authenticates the account.

Wardle published a working proof of concept, named “not-a-mused,” on GitHub. His demonstration went further than the audio: from a compromised Mac session it queried Muse’s inventory of the user’s devices, retrieved a linked iPhone’s location, and started a Bluetooth scan, all through the Muse client and all without anything appearing on screen. He has been blunt about the recommendation, telling reporters people should not install the assistant for now.

What is behind this

The important qualifier is what an attacker needs first. This is not a way to break into a clean Mac from the internet. Something already has to be running as your user account, whether through ordinary malware or because you were talked into running something. What the flaw does is turn that foothold into considerably more than it should be, which is the whole point of the permission system it sidesteps. macOS normally makes an app ask before it can reach your microphone, your camera or another app’s data, and a setting that any process can flip without those checks quietly undoes that protection.

The wider lesson is about what these assistants now hold. Muse is not a note-taking app. It knows your devices, it is linked to your phone, and it holds a token that proves it is you. Any software with that reach becomes a target worth attacking, and it has to be built to a standard that matches, which is a higher bar than most apps are held to. Assistants are being shipped fast right now, and fast and careful are in tension.

What this means for you: If you installed Muse on a Mac, the cautious move is to remove it until Meta ships a fix, and Wardle is saying exactly that. More generally, treat AI assistants with device access as high-privilege software rather than as another app: install fewer of them, prefer ones that have been out long enough to be poked at, and be slower than usual to grant one access to your phone, your files or your accounts. The convenience is real. So is the fact that you are handing over a key.

Sources

• RuntimeWire: Meta’s Muse flaw lets Mac malware reach linked iPhones, researcher says
• iTnews: Security researcher says don’t install Meta’s Muse AI assistant
• Cybersecurity News: Meta’s Muse AI agent 0-day vulnerability