Researcher Finds Meta Muse Flaw That Can Capture User Authentication Tokens

Security researcher Patrick Wardle has disclosed a zero-day in Meta’s macOS Muse assistant that can let code already running on a Mac redirect the assistant’s transcription traffic and capture the user’s Muse authentication token. The result is a possible takeover path for an agent that can connect to personal accounts and use protected device resources.

The weakness lies in an undocumented configuration setting. Wardle found that locally installed apps or terminal commands can change Muse settings regardless of their own macOS permissions. One setting selects the server used for dictation transcription. Changing it from Meta’s server to an attacker-controlled endpoint can expose a person’s voice prompts and the token used to authenticate their Muse account.

A serious escalation, not a remote break-in

The issue is not a remote-code-execution vulnerability against an otherwise clean Mac. An attacker first needs local code execution, through malware, a malicious app, or social engineering. But once that foothold exists, Wardle described a proxy-based proof of concept in which an attacker inserts a malicious command into a voice prompt and captures the token, permanently compromising the Muse account.

What access could be concentrated in Muse

• Muse is designed to handle appointments, forms, customer-service interactions, purchases, and document creation.
• The assistant can connect to WhatsApp, email, calendars, and social platforms.
• With user-granted permission, it may access files, the microphone, camera, location, and calendars on a Mac.

Meta introduced Muse only weeks before the disclosure as a macOS app. Its capabilities make the design choice around endpoint controls more consequential than a routine preference setting: the assistant can hold account connections alongside operating-system permissions granted for its work.

Proofs of concept show the potential reach

Wardle said he developed proof-of-concept attacks that used Muse’s privileges to write malicious files to disk and take pictures, often without visible alerts. Those demonstrations show the potential payoff of compromising the assistant after local access is obtained; they do not mean the flaw itself remotely compromises a Mac.