Patrick Wardle, founder of Objective-See and a former NASA/NSA staffer, has disclosed a zero-day vulnerability in the Meta Muse application on macOS. Malware already running on a Mac can hijack the AI assistant, redirect dictation commands to an attacker-controlled server, and subsequently access a linked iPhone to retrieve its location and perform Bluetooth scans. The proof-of-concept, dubbed “not-a-mused”, was published on September 21, just 4 days after Meta launched Muse on Mac.
“endo_voyager_dictation_endpoint”
The vulnerability lies in an undocumented setting named endo_voyager_dictation_endpoint. According to Wardle, an unprivileged process can modify this setting without administrative permissions, redirecting all dictation traffic from its intended destination to an attacker-controlled server.
Redirecting the endpoint allows attackers to carry out prompt injection as well as session hijacking through trusted AI workflows. Specifically, before data reaches the Muse backend, bad actors can steal victim account credentials, swap or inject malicious instructions directly into the agent, and intercept dictation prompts alongside the user’s audio data.
The most dangerous element is the cross-device interaction feature. Wardle demonstrated that once the Muse application is hijacked, it can use account APIs to access the device list, select an online device, and execute remote commands. In a real-world scenario, the Mac version of Muse retrieved the current location of an iPhone located in Barcelona and initiated a Bluetooth Low Energy scan directly on the phone—all while remaining completely invisible to the user.
‘Access amplification’: Muse helps malware amplify operational capabilities
Although this vulnerability does not enable remote code execution on an uninfected Mac—an attacker must first run code under the user’s account privileges, whether through standard malware or social engineering—Wardle notes that this functions as an access amplification mechanism. Through it, malicious code otherwise restricted by macOS privacy controls can exploit Muse to inherit the extensive privileges granted to the agent by the user.
According to announcements from Meta, Muse can handle files, applications, browser tabs, email connections, calendars, web browsing, shopping, and background tasks. These extensive privileges instantly turn into a dangerous attack tool once the trusted command channel is compromised.
Regarding the timeline, Muse was unveiled on September 8, the macOS version was released on September 17, and Wardle published the PoC shortly after on September 21. Meta has not yet issued an official response to the finding, although the company offers a bug bounty of up to $300,000 for valid Muse vulnerabilities.
Cloud security cannot compensate for client-side flaws
Meta designed Muse’s security architecture with a heavy focus on cloud computing infrastructure, highlighted by two core components: Muse Secure VM (an isolated virtual machine dedicated to storing credentials and data) and the Sentinel service (a server monitoring network traffic and connector actions). Under this mechanism, the agent never comes into contact with raw passwords or authentication tokens, and mobile devices maintain direct connections over secure transport channels.
Nevertheless, Wardle emphasized that cloud isolation becomes ineffective if the local client application is manipulated before data can reach the secure environment. A former AI security engineering manager at Meta was even reportedly unwilling to use Muse due to concerning privacy and information security risks.
Notably, endpoint threat detection solutions often face obstacles distinguishing between legitimate user actions, agent tasks, and attacker tampering, as commands are executed through a trusted, digitally signed application. While this is a classic challenge in endpoint security, the risk is multiplied when an AI agent possesses expansive access to a wide array of connected services.
As a temporary mitigation, Muse users on macOS are advised to: proactively pause the application, review and revoke unnecessary permissions, update credentials if suspicious activity is detected, and continuously monitor the agent’s activity history. For enterprise environments, organizations should tighten controls, restrict the installation of unvetted AI agents on managed Mac devices, and closely monitor any processes attempting to modify Muse’s endpoint configurations.