Researcher Finds Meta Muse Flaw That Can Capture User Authentication Tokens
The flaw is not a remote break-in method, but it can turn code already running on a Mac into a route to an AI agent’s connected accounts and permissions.
Listen to this story
The audio brief
Story brief
3 key pointsPatrick Wardle disclosed a zero-day in Meta’s macOS Muse assistant that lets software already running locally alter an undocumented transcription-server setting. Redirecting Muse to an attacker-controlled endpoint can expose voice prompts and the assistant’s authentication token, enabling account takeover. The flaw requires an existing foothold—such as malware or a malicious app—rather than enabling remote compromise of a clean Mac.
- 01
Muse’s transcription endpoint can be changed by local apps or terminal commands regardless of their macOS permissions.
- 02
Wardle’s proxy proof of concept used a voice prompt to inject a malicious command and capture a token.
- 03
Muse can connect to WhatsApp, email, calendars, social platforms, and support appointments, forms, purchases, and document creation.
Security researcher Patrick Wardle has disclosed a zero-day in Meta’s macOS Muse assistant that can let code already running on a Mac redirect the assistant’s transcription traffic and capture the user’s Muse authentication token. The result is a possible takeover path for an agent that can connect to personal accounts and use protected device resources.
The weakness lies in an undocumented configuration setting. Wardle found that locally installed apps or terminal commands can change Muse settings regardless of their own macOS permissions. One setting selects the server used for dictation transcription. Changing it from Meta’s server to an attacker-controlled endpoint can expose a person’s voice prompts and the token used to authenticate their Muse account.
A serious escalation, not a remote break-in
The issue is not a remote-code-execution vulnerability against an otherwise clean Mac. An attacker first needs local code execution, through malware, a malicious app, or social engineering. But once that foothold exists, Wardle described a proxy-based proof of concept in which an attacker inserts a malicious command into a voice prompt and captures the token, permanently compromising the Muse account.
What access could be concentrated in Muse
- Muse is designed to handle appointments, forms, customer-service interactions, purchases, and document creation.
- The assistant can connect to WhatsApp, email, calendars, and social platforms.
- With user-granted permission, it may access files, the microphone, camera, location, and calendars on a Mac.
Meta introduced Muse only weeks before the disclosure as a macOS app. Its capabilities make the design choice around endpoint controls more consequential than a routine preference setting: the assistant can hold account connections alongside operating-system permissions granted for its work.
Proofs of concept show the potential reach
Wardle said he developed proof-of-concept attacks that used Muse’s privileges to write malicious files to disk and take pictures, often without visible alerts. Those demonstrations show the potential payoff of compromising the assistant after local access is obtained; they do not mean the flaw itself remotely compromises a Mac.
Editorial analysis
Our Read
Muse’s utility depends on combining account connections with access to a user’s computer. That same design concentrates value behind the assistant’s authenticated session: an attacker who reaches it may not need to separately extract every account connection or device permission. The immediate security issue is the transcription-endpoint control Wardle identified, not an ordinary remote takeover of a clean Mac. The consequential next step would be a change that prevents unprivileged local software from altering sensitive routing settings, especially in agents designed to work across personal communications and files.
Sources
- arstechnica.comMuse, Meta's extraordinarily privileged AI assistant, has a serious 0-day
- malwarebytes.comMeta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor
Reader comments
Newest comments first. Replies stay oldest first.