Meta Muse macOS flaw let local software redirect voice traffic, researcher says

A security researcher says Meta’s Muse desktop AI client for macOS contained an unpatched flaw that let locally running software redirect voice-dictation traffic to an attacker-controlled server. Meta has since deployed a hotfix, according to InfoQ, but the episode shows how an AI agent’s broad permissions can turn a small configuration mistake into a much larger security problem.

Meta AI Watch analysis

What happened

Patrick Wardle, founder of the Objective-See Foundation, disclosed a vulnerability in Muse’s undocumented endovoyagerdictationendpoint setting, InfoQ reports. A process already running on the Mac could alter the setting without administrator privileges or a new macOS authorisation prompt.

That could redirect dictation audio and Muse authentication tokens to a server controlled by an attacker. Wardle’s proof of concept, called not-a-mused, also demonstrated how a compromised agent could be pushed into unauthorised actions through prompt injection, including attempts to access local documents or WhatsApp message histories, according to the report.

InfoQ says Meta later removed the debugging preference from production builds. The report describes the issue as requiring prior code execution on the Mac, so this was not a remote internet break-in by itself. It also says the vulnerability has no official CVE designation and that Meta did not publish a formal security advisory.

What we know

• Local execution required
  The reported attack depended on malicious software or commands already running on the Mac.
• Voice traffic at risk
  The altered setting could redirect dictation audio and associated Muse session credentials.
• Agent permissions amplified the problem
  Muse’s access to files, applications and accounts could make a compromised session more consequential than a simple audio interception.
• A hotfix was deployed
  InfoQ reports that Meta removed the internal setting from production builds, although the supplied report does not establish which app versions are covered or how the fix was independently tested.

Why it matters

AI agents are often sold on their ability to move between applications and act on a person’s behalf. That usefulness also gives them a large blast radius when their boundaries fail. Here, the reported weakness was not a model hallucination or a clever prompt alone. It was a local configuration value that could redirect the agent’s communications before the operating system’s usual permission machinery stepped in.

Muse users on macOS should install available application updates and treat other software requesting access to Muse, the microphone, files or connected accounts with suspicion. The report does not establish that every affected build has been fixed, so users should look for Meta’s version-specific guidance rather than assume that any recent launch is automatically safe. The robot assistant may be eager to help. It should not also be a convenient side door.

Our read

This is a material AI-security story because the vulnerability concerned an agent with access to real accounts and system resources, not merely a chatbot producing dubious prose. Meta’s hotfix is welcome, but silent remediation leaves users with less information about exposure, affected versions and whether credentials or audio may have been accessed.

The practical lesson is architectural: agents need isolation, narrowly scoped permissions and visible security advisories. Asking the model to behave better is not a substitute for making the surrounding software harder to hijack.

What to watch

• Meta’s version-specific guidance and any explanation of affected macOS builds.
• Whether the company provides evidence that the hotfix closes the reported path.
• Any reports of exposed Muse tokens, audio or account activity.
• Whether AI-agent developers publish formal advisories for similar configuration and permission flaws.

Discussion spark: Should AI agents with access to files, accounts and microphones be required to publish formal vulnerability advisories, even when a flaw needs malware already running locally?

not affiliated with, endorsed by, or operated by Meta