The Muse artificial intelligence assistant from Meta has been found to be vulnerable to an attack which allows malicious software to redirect its dictation traffic and control the actions performed by the application if it is locally running malware.
The issue was demonstrated by security researcher Patrick Wardle in a proof-of-concept published on September 21, which demonstrates how an attacker with code execution rights under the user logged into Muse can exploit a hidden configuration in Muse. Wardle has also emphasized that the vulnerability does not provide an initial entry point into a Mac, but rather becomes dangerous after a malicious program or attacker has already been installed on the device.
In addition, Wardle also warned that the attack may be delivered remotely via a ClickFix-style method, in which the victim is persuaded to execute a command without downloading or installing traditional malicious software. The Meta AI agent Muse was launched earlier this month as a personal AI agent capable of interacting with services and applications based on user permissions. Its capabilities include file sharing, email, messaging, calendars, shopping services, and smart-home applications. As a result of these permissions, the malicious process does not have to obtain the same access independently, making them particularly relevant to this attack.
There is a problem with an undocumented Muse preference named endo_voyager_dictation_endpoint that controls the location where voice dictation is processed. The setting can be modified by an application running under the same user account. No additional macOS permission is necessary to modify the setting so that Meta's legitimate endpoint is replaced with an attacker's endpoint.
A redirected endpoint can allow voice input intended for Muse to be sent to a service controlled by the attacker. Testing has demonstrated that both the audio and transcription can be intercepted. Once the input has been captured, the attacker can observe dictated prompts and influence Muse's instructions.
A further significant benefit of the redirected traffic is that the token associated with the user's Muse account can be accessed and used to interact directly with Muse. Wardle demonstrated that the token can be accessed and used directly to access the account's chat history. Thus, malicious code is no longer simply stealing information, but rather abusing the AI assistant itself in order to carry out actions based on the privileges that have already been assigned.
A secondary concern is how conventional endpoint security tools might interpret the activity. The Muse application is a legitimate, signed application, so actions initiated through it may appear to originate from a trusted process rather than directly from malware. Wardle's testing further revealed that access obtained through Muse tokens may extend beyond the compromised computer.
Using the token, the researcher was able to execute commands through Muse on another device since the same account can be used across multiple devices. In testing, the researcher was able to have the assistant on a smartphone report its location, scan for nearby Bluetooth devices, and identify smart home controls.
Meta Releases Hotfix for Muse Zero-Day
The vulnerability has been addressed by Meta with a hotfix for Muse on MacOS. According to David Singleton of Meta Superintelligence Labs, the issue involves a local privilege escalation rather than a remote vulnerability. Moreover, exploitation requires malicious software to have already been installed under the user's account.
By closing the configuration path that Wardle used in his proof-of-concept, the hotfix removes the ability to modify the dictation endpoint. As Meta stated, there was a limited practical risk associated with the attack since it requires the installation of local code. However, the requirement for local code execution does not necessarily exclude realistic attack scenarios. Wardle cited ClickFix-style attacks, in which victims are tricked into executing commands on their own computers.
By employing such a method, one might be able to gain a foothold without having to install conventional malware in order to exploit the Muse vulnerability. A broader concern with artificial intelligence agents that operate with extensive permissions has been highlighted by the vulnerability. As a result of Muse accessing a wide range of system resources and connected services, it may be possible for attackers to use those existing permissions once they have obtained control of the agent, rather than requiring separate access to each protected resource.
In Wardle's testing, he demonstrated that the vulnerability can be exploited for a variety of purposes beyond the theft of dictated information. As part of the proof-of-concept activity, the user was able to take images and create documents on the Mac using Muse, in some cases without being made aware of.
In addition, the research demonstrated that attackers controlling Muse sessions may interact with connected devices, although some actions are limited to the preparation of drafts during testing. This vulnerability does not imply the bypassing of macOS's underlying permission system directly, but rather the abuse of Muse once sensitive capabilities have been granted. As a result, the compromised process may be able to make requests through legitimate, signed applications, potentially making the results harder to distinguish from normal AI-aided operations. Moreover, the dictation system design of Muse contributed to the vulnerability as well. While Apple's dictation capabilities are available on device, Muse transmits voice inputs to Meta's infrastructure for processing.
Wardle argued that this architecture created an endpoint that can be redirected by another local process. Several security and isolation controls have been implemented in the context of Muse, including its dedicated Secure VM architecture and additional safeguards designed to limit agent actions. However, the flaw revealed is not in the cloud environment designed to isolate user agents but in the macOS application itself.
Personal artificial intelligence agents are increasingly being seen as sources of security concerns, particularly those that provide conversational capabilities as well as access to files, devices, accounts, and external services. In the event of an agent weakness, those permissions can be turned into an attack path. However, even if the underlying operating system enforces its normal security boundaries, the agent could potentially act as an attack vector.
