Meta’s latest personal AI assistant, Muse, launched on Mac earlier this month to perform tasks across apps and accounts, allowing users to send messages, process payments, fill forms, and more. To power those capabilities, Muse requires broad access to local resources—access that has now enabled a serious security issue.
What Went Wrong
Security researcher Patrick Wardle discovered a zero-day vulnerability in the Muse app on macOS that allows any local app or Terminal command to modify undocumented Muse settings without needing special system permissions. One of those settings, endo_voyager_dictation_endpoint, determines where Muse sends dictated prompts. Through this flaw, an attacker could redirect those voice inputs from Meta’s servers to a server controlled by the attacker.
Once a malicious actor reroutes dictated content, they could acquire the authentication token for the user’s Muse account. That token gives the attacker full control of that agent, enabling misuse of voice input to execute actions ranging from writing files on the Mac to taking camera photos. In proof-of-concept tests, Wardle also used a compromised Muse account to reveal the location of a linked iPhone.
Attack Requirements & Severity
This is a local vulnerability. An attacker must already have code execution capability on the Mac. While there’s no evidence that this alone enables remote takeovers by itself, it could be combined with a social engineering method—such as tricking someone into pasting a malicious Terminal command via a ClickFix-style attack—to achieve remote-level compromise.
Another misstep was Muse’s reliance on server-side processing of voice dictation. Apple offers on-device dictation technology that would have avoided exposure of user prompts to remote endpoints, but Meta chose to send voice data off-site—creating a broader attack surface.
Fix and What Users Should Do
Meta has reportedly issued a patch for Muse on Mac to address this vulnerability. Users are strongly advised to install the update immediately.
The discoverer emphasized how quickly the issue was fixed—and gave credit for Meta’s transparency—but also highlighted that the real danger comes when trusted AI agents are granted extensive access, making them attractive targets for attackers.
Muse’s security model has been heavily promoted by Meta. The company claimed the tool was built “from the ground up” for privacy and security, featuring Secure VMs, monitoring engines coined Sentinel, and bug bounty rewards up to $300,000. But this incident shows that lofty promises can still be undermined by implementation shortcuts. Muse, unlike many AI agents, operates with high privileges and interacts with system-level functions—something users should understand before entrusting it with sensitive tasks.
Ultimately, this episode underscores a broader trend: as AI agents become more deeply embedded in everyday workflows, the risk of privilege misuse grows. Developers must balance functionality and security, especially around voice processing and system permissions. For the user, the takeaway is urgent: patch your systems, review AI agent permissions, and stay skeptical of claims that convenience can’t come with trade-offs.
