Meta has issued a hotfix for its Muse Mac app after a security researcher showed how software running under a user’s account could redirect voice dictation and take control of the AI assistant. The attack could expose an authentication token and allow the attacker to use services the owner had connected to Muse.
Patrick Wardle published a proof of concept on Monday. It targets an undocumented app setting, endo_voyager_dictation_endpoint, that determines where dictated prompts are sent. A local process could change the setting without administrator privileges, pointing Muse’s dictation traffic at an attacker-controlled address.
The route required the user to click the microphone button and dictate a prompt. Wardle’s demonstration showed that the redirected traffic could reveal the spoken request and Muse authentication material. His code also showed how an attacker could add instructions and issue commands through the agent.
Wardle’s repository makes the prerequisite explicit: the attacker must already be able to run code as the logged-in Mac user. The flaw did not, by itself, provide a way to break into a Mac over the internet. Wardle said a ClickFix lure, which tricks a user into pasting a command into a terminal, could have supplied that initial foothold.
David Singleton of Meta Superintelligence Labs said the company had issued a hotfix and removed the endpoint setting from production builds. He characterized the problem as local privilege escalation and said it did not involve a compromise of Muse’s cloud servers or its isolated virtual machine. Wardle acknowledged the fix on Tuesday.
The scope of a hijack would depend on what the user had authorized Muse to access. Meta markets the assistant as able to work across connected apps, manage email and travel, and use a browser to complete tasks. It says sensitive actions such as sending an email or making a purchase require user approval. The breadth of those permissions explains why Wardle warned that a local foothold could be turned into a wider compromise of the user’s accounts.
The issue sits at the boundary between a relatively ordinary local foothold and a much more capable agent. Muse’s permissions are meant to let it act for the user; an attacker who can control that session may inherit access that the original malicious process did not have. Earlier research on agent identity and access has focused on similar questions about how software should distinguish an authorized user request from an agent action.
The publicly documented case is a researcher-controlled demonstration, not evidence that Muse customers were attacked. Meta’s hotfix addresses the specific dictation setting Wardle used. Users who installed Muse on a Mac should ensure the app has updated, and review the connected services and device permissions they have given it.
Sources: Patrick Wardle, Meta, The Register
–
By the Control Plane Editorial Team