Meta News

A security researcher has demonstrated how malware already running on a Mac could hijack Meta’s new Muse AI assistant, potentially giving attackers access to far more information and capabilities than the malware could reach on its own.

The proof-of-concept, developed by macOS security researcher Patrick Wardle, targets an undocumented Muse configuration setting controlling where voice dictation is sent. By modifying that setting, malicious software running under the logged-in user’s account could redirect dictated prompts to infrastructure controlled by an attacker.

The vulnerability does not provide an initial way into a Mac. An attacker must already be capable of executing code as the user. However, the research illustrates a broader security concern surrounding powerful AI agents: once users grant an assistant extensive permissions, compromising the assistant can potentially provide a shortcut to everything it can access.

Muse, launched by Meta in the United States this month, is designed as a personal AI agent capable of interacting with files, email, messages, calendars, shopping services and smart-home applications.

Users decide which resources Muse can access, but those permissions can become valuable to attackers.

Wardle discovered an undocumented preference in the macOS version of Muse calledendo_voyager_dictation_endpoint. The setting determines where the application sends voice dictation.

According to the research, another program running as the logged-in user could modify this value without requesting additional permissions. Muse would then send dictated information to the attacker’s chosen destination rather than Meta’s intended service.

Wardle’s demonstration showed that an attacker could intercept what the user dictated, insert additional instructions into the interaction and capture an authentication token associated with the Muse account.

That token significantly increases the potential impact.

Muse accounts can operate across multiple devices.

Wardle demonstrated that after obtaining the authentication token, an attacker could interact with the victim’s Muse account beyond the originally compromised Mac.

In his test environment, he used the token to instruct Muse running on an iPhone to report the device’s location, scan for nearby Bluetooth devices and identify available smart-home commands.

The assistant did not automatically send messages during Wardle’s tests, instead preparing drafts, which demonstrates that some action restrictions remained in place.

Nevertheless, the experiment shows why authentication tokens belonging to AI agents could become particularly valuable targets.

Stealing a conventional application token might provide access to one service. Taking control of an AI agent connected to numerous services could potentially expose information distributed across many different systems.

macOS includes protections designed to prevent applications from freely accessing sensitive resources belonging to other software.

An ordinary malicious program may therefore encounter permission barriers when attempting to access microphones, files, credentials or other protected information.

But an authorized AI agent may already possess many of those permissions.

Instead of attacking every protected resource individually, malware could attempt to manipulate the trusted agent and make it perform actions using permissions the user has already granted.

Wardle describes this as one of the central dangers of increasingly capable desktop AI assistants.

It also creates a detection challenge.

Security software monitoring application behavior may see commands originating from a legitimate, signed Muse application rather than an obviously malicious executable. The malicious software effectively uses the trusted agent as an intermediary.

There are important limitations to the research.

The technique does not bypass macOS protections preventing one application from directly reading another application’s protected credentials. Instead, the authentication token becomes exposed because Muse itself sends it during the redirected interaction.

The demonstration also does not represent a compromise of Meta’s cloud infrastructure.

Meta designed Muse with isolated cloud environments and additional mechanisms intended to validate agent actions. Wardle’s attack targets the macOS client before those protections become relevant.

The distinction is important because the underlying issue is not that an attacker remotely compromises Meta’s servers. Rather, malware with existing local access can potentially exploit the trust relationship between the user, the operating system and a highly privileged AI assistant.

Wardle also suggested that the risk could have been reduced by relying on Apple’s built-in on-device dictation mechanisms rather than implementing a separate system that transmits dictation elsewhere.

Wardle publicly released his proof-of-concept on September 21 rather than privately reporting the issue to Meta beforehand.

He subsequently said Meta had pushed a change that he characterized as a fix. At the time of The Hacker News report, however, Meta had not published a security advisory explaining what had changed, and the publication said it could not independently confirm the scope of the fix.

Until the situation is clarified, users concerned about exposure can reduce Muse’s permissions, avoid unnecessary integrations and be particularly cautious about instructions asking them to paste commands into Terminal.

The latter matters because Wardle noted that an attacker could potentially obtain the initial local execution needed for the attack through ClickFix-style social engineering, where victims are persuaded to copy and execute a command themselves.

The research highlights a problem likely to become increasingly important as personal AI agents gain more capabilities.

Traditional applications generally have relatively narrow purposes and permissions. Agentic assistants are moving in the opposite direction: they are designed to connect services, understand personal context and take actions across multiple applications.

That makes them useful, but it also concentrates trust.

An attacker who compromises an ordinary application may gain access to that application’s information. An attacker capable of controlling a deeply integrated AI agent could potentially inherit a much broader collection of permissions.

Muse’s hidden dictation setting provides an early example of how seemingly minor client-side weaknesses can become considerably more consequential when they exist inside an AI agent.

As these assistants become more powerful, securing the model itself will be only part of the problem. The applications, authentication tokens, integrations and local configuration surrounding the model may ultimately determine how much damage an attacker can cause.