Researcher Shows Hidden Muse Setting Could Turn Meta's Mac Assistant Into a Backdoor

A hidden setting in the Mac version of Meta's Muse assistant could let malware already running on a machine quietly redirect the user's dictated prompts to an attacker, security researcher Patrick Wardle demonstrated in a proof-of-concept released on September 21.

The flaw only works if an attacker can already run code as the logged-in user, and cannot break into a Mac by itself. Wardle told The Hacker News a remote attacker could hijack Muse through a ClickFix trick, which fools users into running a single command.

Muse is the personal AI agent Meta launched this month in the United States. Once enabled, it can work across files, email, messages, calendar, shopping and smart-home apps, using whatever access the user grants. Wardle urged people not to install it, calling it "trivial to turn Muse into the ultimate backdoor."

The undocumented setting, stored in the app's preferences as endo_voyager_dictation_endpoint, decides where Muse sends dictation. Any program running as the logged-in user can point it at an attacker-controlled address without extra permissions. Wardle showed an attacker could then read dictated text, add instructions Muse trusts, and capture a token signing in to the user's Muse account - giving control of the assistant across devices.

Wardle said he did not report the flaw before going public, choosing full disclosure so users understand the risk. He said Meta has since pushed out what he called a "fix," pointing to a post on X. The Hacker News could not confirm what the change does and has reached out to Meta, which has not published a security advisory.

Until Meta confirms a fix, users can quit or remove Muse, review its permissions, change passwords on exposed accounts, avoid its voice input, and never paste commands from a website or message into Terminal.

Source: The Hackers News