Meta’s Muse AI 0-Day Lets Hackers Hijack Dictation Traffic and Inject Malicious Prompts

A recent proof-of-concept (PoC) developed by security researcher Patrick Wardle reveals a local zero-day vulnerability in the Muse application. This vulnerability allows malware running under the logged-in user’s account to redirect dictation traffic to a server controlled by an attacker.

The issue is documented in Wardle’s “not-a-mused” research repository. It focuses on an undocumented Muse configuration value called `endo_voyager_dictation_endpoint`, which determines where the application sends requests related to dictation. According to Wardle, a local process without administrative privileges can change this setting.

By modifying this endpoint, malicious software could intercept the audio that a user dictates when activating Muse’s microphone feature. Additionally, altered routing could let an attacker send crafted responses that Muse processes as part of its dictation workflow, creating a potential prompt-injection vulnerability.

Wardle’s PoC demonstrates this risk by setting up a local service that receives the redirected requests. This project implements only a subset of the more than 50 commands Muse exposes, showcasing the security flaw rather than providing an alternative backend.

The implications of this vulnerability extend beyond simply exposing voice data. The repository warns that intercepted traffic may include authentication materials for Muse.

If tokens or other reusable credentials are captured through this redirected traffic, malware could assume the permissions the user granted to Muse. This situation could turn an application-level trust relationship into an opportunity for an attacker already present on the endpoint to amplify access.

This is not a remote code execution vulnerability. An attacker must first gain the ability to execute code within the target user’s account, this could be achieved through methods such as a trojanized application, phishing attacks, or other local execution vectors.

However, locally executable malware often operates without needing elevated operating system privileges; by targeting a trusted AI client, it can access cloud-connected data and perform actions that would otherwise be inaccessible.

This distinction matters for organizations deploying AI assistants with access to email, documents, internal services, or other sensitive resources.

Managing permission scopes, token handling, and outbound endpoint controls is just as important as traditional host-level privilege boundaries. A compromised local account may not need to bypass system protections if it can leverage the existing session of a trusted assistant.

To protect against this threat, defenders should identify endpoints running Muse, analyze their exposure to user-writable application configurations, and monitor for unexpected changes to dictation or AI service endpoint settings.

Network teams should also monitor for Muse traffic being sent to unauthorized destinations. In contrast, incident response teams should consider rotating affected application credentials if they suspect manipulation.

Until a vendor fix or official mitigation becomes available, the most effective safeguards are minimizing Muse’s access to only necessary resources and preventing untrusted code from running in user contexts.

The PoC is presented explicitly for security research and educational purposes, but it highlights how voice interfaces can create new interception and prompt-manipulation opportunities within AI-enabled workflows for enterprise security teams.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC