- Published on
One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor
- Authors
- Name
- DeepHorus
Security researcher Patrick Wardle has demonstrated a critical vulnerability in Meta's Muse AI assistant for macOS, showing how a hidden setting could allow attackers to turn the personal agent into a powerful backdoor. The proof-of-concept, released on September 21, reveals that malware already running on a Mac can quietly hijack the assistant's core functions. This flaw highlights significant security risks in the new AI tool, which was launched in the United States earlier this month.
Muse is designed as a personal AI agent that integrates deeply with a user's digital life. Once activated, it can access files, email, messages, calendar, shopping, and smart-home apps based on the permissions granted. The vulnerability discovered by Wardle exploits an undocumented setting that controls where the assistant sends dictation data. This setting, named endo_voyager_dictation_endpoint, resides in the Mac app's preferences.
The attack works by redirecting the user's spoken prompts to an attacker instead of Meta. An attacker who already has code execution privileges on the target Mac can modify this setting without requiring additional permissions. The attack leverages a ClickFix social engineering trick, where a user is fooled into running a single command. Wardle emphasized that this is "trivial to turn Muse into the ultimate backdoor."
Once hijacked, the attacker gains access to three critical capabilities: reading dictated text, injecting trusted instructions for Muse to execute, and capturing the user's authentication token. With this token, the attacker can control the Muse account from any device, not just the compromised Mac. Wardle demonstrated this by controlling his iPhone via the captured token, instructing it to report its location and scan for nearby Bluetooth devices.
The implications are severe. macOS normally isolates apps to prevent one from accessing another's data. By using Museāa legitimate, signed applicationāan attacker circumvents these protections. Wardle noted that security software may not flag the activity because the commands appear to originate from Muse itself. However, the attack does not break Meta's cloud security or bypass the system that protects saved passwords.
Wardle chose full disclosure without notifying Meta beforehand to accelerate a fix. He stated that Meta has since pushed out an update he described as a "fix," though the company has not published a formal security advisory. The Hacker News has reached out to Meta for confirmation and details on the change.
In the meantime, Wardle recommends immediate actions for Mac users. Users should quit or uninstall Muse, review and revoke unnecessary permissions, and avoid using voice input. If a machine is suspected to be compromised, affected users should treat their Muse and linked accounts as exposed, changing passwords immediately.
