One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor
Patrick Wardle's PoC shows local Mac malware can redirect Meta Muse dictation and hijack granted access.
Researcher Patrick Wardle released a September 21 proof-of-concept showing malware already running as the logged-in Mac user can retarget Meta's Muse assistant. An undocumented preference, endo_voyager_dictation_endpoint, can be changed without extra permissions so dictated audio and text go to an attacker-controlled local program instead of Meta. The attacker can read prompts, append instructions Muse acts on, and reuse the session token. With that token, Wardle directed Muse on an iPhone to report its location, run a Bluetooth scan, and list smart-home commands; messages were only drafted. The flaw is not remote entry and does not bypass macOS password isolation or Meta's cloud separation. No patch is available.
- Requires code already running as the logged-in Mac user, not remote access.
- Hidden setting endo_voyager_dictation_endpoint redirects dictated prompts to an attacker.
- Attacker can inject instructions and steal the Muse session token.
- A stolen session drove iPhone Muse location, Bluetooth, and smart-home actions.
- No patch yet; Meta's cloud isolation was not shown broken.
- Organizations
- Meta
- Countries
- United States
- AI models
- Muse
From the original article
3 min read at thehackernews.com
Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. The flaw is in
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.