Meta's Muse agent can be repointed by any local process

Any program running as a signed-in Mac user can change where Meta's Muse assistant sends its dictation, according to a proof-of-concept released on 21 September. Once that traffic is redirected, the words a user speaks into Muse, and the access the user granted the app, both belong to whoever owns the endpoint.

One preference decides where dictation goes

The proof-of-concept, published by the macOS security researcher Patrick Wardle, documents a single preference that the Mac build of Muse reads to decide where dictation is forwarded: endo_voyager_dictation_endpoint. Nothing stops an unprivileged local process from rewriting it. No entitlement is needed, no admin password is requested and macOS shows no prompt, so the assistant carries on behaving normally while spoken prompts arrive at a machine the attacker controls. The setting is undocumented, and Wardle's tool implements only a subset of the more than fifty commands Muse exposes.

What an attacker gets from the redirect

Three outcomes follow from the same redirect. The attacker can read what the user dictated, add instructions that Muse treats as the user's own words, and take the authentication material that identifies the Muse session. The third is the one that travels, because a Muse account works across devices.

With a session captured this way, Wardle drove the Muse app on his own iPhone, asking it to report the phone's location, run a Bluetooth scan of nearby devices and list the smart-home commands it could send. In his tests the assistant drafted messages rather than sending them on its own, and dictation had to be triggered by the user for the redirect to fire.

What the flaw is not

This is a local attack. It needs malware or a foothold that can already execute code as the signed-in user, so it is not a way into a Mac from the network. It does not defeat the part of macOS that keeps one app from reading another app’s saved passwords, and it does not show Meta’s cloud isolation failing: the commands are issued by Muse itself, using permissions the user handed over. Wardle’s own summary puts the risk plainly: ‘Muse’s access can potentially become the attacker’s access.’ His advice to the people who asked, at the time he disclosed the flaw, was that they should not install the app while the weakness was unfixed.

What Mac users can do now

Meta’s hotfix

Meta says it has already fixed this. In a statement posted on X, David Singleton of Meta Superintelligence Labs said the company had issued a hotfix to the Muse Mac app, and that the version which shipped carried an internal setting letting developers point dictation at a different server for debugging and development. Because that preference lived in the app’s own local settings, any process running under the user’s account could rewrite it. Meta says the fix removes the setting, which closes the route the proof-of-concept used. Singleton also pushed back on the severity: he describes what Wardle found as a local privilege escalation rather than a remote exploit, and argues the practical risk to users was low because an attacker would need malicious code running on the machine under that user’s account first. The statement does not name the app version that carries the fix.

Update the app rather than removing it. Meta says the fix has already landed, so the practical steps are to keep the Mac build current, to review the permissions Muse holds and revoke anything it does not need, and to treat voice input as a privileged action while the endpoint it uses is one the user cannot see or verify. If a Mac may already have been compromised, the accounts connected to Muse are the ones worth changing passwords on.

Our opinion

The interesting part of this bug is not the redirect; it is the choice that made the redirect powerful. Meta built its own dictation pipeline so Muse could send speech off the device, rather than leaning on the on-device dictation Apple already ships, and that put a plain text preference squarely inside a trust boundary. An assistant that can reach files, mail and the lights magnifies every local bug into an access bug, which is precisely the trade Meta asked users to make. The durable fix is not a single patch: dictation endpoints, and every other addressable target inside an agent, should be locked to first-party destinations that ordinary processes cannot rewrite. Meta has shipped a capable product and left the hinge on the outside of the door.