Meta Muse AI app flaw lets local malware redirect dictation traffic

Researcher Patrick Wardle's PoC shows unprivileged local code can hijack Meta Muse macOS dictation traffic, exposing voice prompts and abusing app access.

Patrick Wardle of Objective-See released a proof-of-concept dubbed 'not-a-mused' demonstrating a local zero-day in Meta's Muse macOS AI assistant app. An unprivileged local process can modify the undocumented endo_voyager_dictation_endpoint setting to redirect dictation traffic to an attacker-controlled server, exposing dictated audio, prompts, and authentication material, and enabling prompt injection or abuse of permissions granted to the app. The flaw is not remotely exploitable and requires prior local code execution, effectively acting as a privilege escalation for local malware. Wardle argues broad-access AI apps undermine Apple's TCC privilege separation and complicate EDR detection, and notes Meta could have avoided the issue by using Apple's on-device dictation API.