Threat
One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor
Publication date not yet evaluated · Added · 2 reports thehackernews.com
Page published · Page updated
Coverage timeline
Why it matters
The Meta Muse flaw shows how AI assistants that require broad system access can undo macOS privilege-separation protections, giving local malware far broader reach — including prompt injection and credential theft — than it would otherwise have.
Security researcher Patrick Wardle (Objective-See) disclosed a local zero-day in Meta's Muse AI assistant macOS app, publishing a proof-of-concept called 'not-a-mused'. An undocumented setting, endo_voyager_dictation_endpoint, can be modified by an unprivileged local process to redirect Muse's dictation traffic to an attacker-controlled endpoint, potentially exposing dictated audio and prompts and enabling prompt injection, theft of authentication material, and abuse of access granted to the app.
Summary
Security researcher Patrick Wardle of the nonprofit Objective-See disclosed a local zero-day in Meta's Muse AI assistant app for macOS, publishing a proof-of-concept named not-a-mused. The flaw centers on an undocumented setting, endo_voyager_dictation_endpoint, that an unprivileged local process can modify to redirect Muse's dictation traffic to an attacker-controlled endpoint.[0][2]
Exploitation requires the ability to execute local code and is not exploitable by a remote attacker, so the practical significance is that local malware can gain far broader access than it otherwise would by abusing the sweeping permissions granted to the AI app. Consequences could include prompt injection, theft of authentication material, exposure of dictated audio and prompts, and abuse of any access the user has granted to Muse. As of publication Meta had not responded to a request for comment and no patch was reported.[0]
Attack chain
- Local code execution prerequisite: An attacker must already be able to run unprivileged code on the victim's macOS system; the flaw is not remotely exploitable.[0]
- Configuration tampering: The unprivileged local process modifies Muse's undocumented endo_voyager_dictation_endpoint setting without special privileges to point dictation traffic at an attacker-controlled endpoint.[0]
- Traffic redirection and abuse: Muse's dictation traffic, including dictated audio and prompts sent to the backend AI model, is redirected to the attacker, enabling prompt injection, theft of authentication material, and abuse of access the user granted to Muse.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-09-21 | The Register published Patrick Wardle's proof-of-concept disclosure of the Muse macOS local zero-day; Meta did not immediately respond to a request for comment.[0] |
How it works
Muse relies on an undocumented configuration setting named endo_voyager_dictation_endpoint that specifies where the app sends dictation traffic. Because an unprivileged local process can modify this setting without special privileges, an attacker running local code can point dictation traffic at an attacker-controlled endpoint, exposing dictated audio and prompts sent to the backend AI model and opening the door to prompt injection, theft of authentication material, and abuse of access granted to the app.[0]
Wardle characterizes the issue as a privilege escalation weakness: AI apps like Muse request or require broad access to data and tools, which undermines macOS protections such as Apple's Transparency, Consent, and Control (TCC) framework and makes the app a single point of failure. He notes that Apple offers on-device local dictation, and had Meta used that API the vulnerability would not exist.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Meta Muse AI assistant app for macOS | Version exposing the undocumented endo_voyager_dictation_endpoint setting as demonstrated by the not-a-mused proof-of-concept | No patch reported; Meta did not immediately respond to a request for comment.[0] |
Key takeaways
- AI assistant apps that require sweeping access to data and tools can undermine operating system security controls such as Apple's TCC framework, turning the app into a single point of failure that local malware can abuse to escalate its effective access.[0]
- A single undocumented, unprivileged-writable configuration setting can let local malware redirect an AI app's dictation traffic, enabling prompt injection and theft of authentication material—an avoidable risk had the vendor used Apple's on-device dictation API.[0]
Defensive actions
- Monitor for local modification of Muse's undocumented endo_voyager_dictation_endpoint configuration setting and for unexpected redirection of Muse dictation traffic.: Tampering with this setting is the core exploitation step and would redirect sensitive dictation audio and prompts to an attacker-controlled endpoint.[0]
- Constrain and scrutinize the permissions granted to AI assistant apps, and prefer on-device dictation where available.: The broad access AI apps request undermines macOS controls like TCC and turns the app into a single point of failure; Wardle notes Apple's on-device dictation API would have avoided the flaw.[0]