One Config Key Let Any Local Process Hijack Meta Muse on macOS

Security researcher Patrick Wardle, founder of the Objective-See Foundation, disclosed an unpatched zero-day vulnerability in Meta's Muse macOS desktop client — an autonomous AI assistant that Meta CEO Mark Zuckerberg publicly described as built from the ground up for privacy and security. The flaw lets any locally running, unprivileged process silently reroute Muse's dictation traffic, capturing live microphone audio, valid session tokens, and the ability to inject arbitrary commands into the agent's pipeline. Because Muse operates as a deeply integrated system agent — with user-granted access to files, calendars, email, audio hardware, and WhatsApp message histories — the blast radius extends well beyond a typical app-level compromise.

The vulnerable mechanism: endo_voyager_dictation_endpoint

The root cause is a single undocumented configuration preference key named endo_voyager_dictation_endpoint. Under normal operation, this key specifies the cloud endpoint that receives raw dictation audio and returns transcriptions. The critical defect: any local process or shell command running in an unprivileged user context can overwrite this value without triggering a macOS authorisation prompt or requiring elevated administrative rights.

An attacker who sets this key to an attacker-controlled server receives two things simultaneously: the raw microphone audio stream and the valid Muse account authentication token that the client appends to each dictation request. Wardle demonstrated that a transparent proxy at that endpoint can forward traffic to Meta's legitimate servers to suppress detection, while silently harvesting credentials and audio. Armed with a hijacked command pipeline, an attacker can also conduct prompt injection — appending hidden instructions to intercepted voice requests to direct the agent to exfiltrate local documents or WhatsApp message histories as background tasks without visible user-facing feedback. Wardle published a proof-of-concept exploit named not-a-mused demonstrating execution of multiple such commands through the hijacked agent.

Access amplification and TCC erosion

The architectural problem is what Wardle termed access amplification. macOS enforces hardware and data access through its Transparency, Consent, and Control (TCC) framework, which gates microphone access, full disk access, calendar data, and contact records behind explicit user consent dialogs. Because users routinely grant Muse broad TCC permissions to enable its agent functionality, an attacker does not need to socially engineer those grants independently — they inherit them by co-opting the already-trusted, Apple-signed Muse process.

This is qualitatively different from a standalone infostealer. Malware that requests microphone or full-disk access on its own triggers TCC dialogs and may be flagged by endpoint security tools. Hijacking a signed agent that already holds those grants bypasses that detection surface entirely. A former Meta AI security engineering manager stated publicly they would not use Muse given the risks inherent to its level of deep system integration.

Disclosure, hotfix, and the CVE gap

Meta deployed a hotfix after Wardle's public disclosure, stripping the endo_voyager_dictation_endpoint preference key from production client builds to prevent local modification. The company did not coordinate with a CVE Numbering Authority, and the vulnerability carries no official CVE designation. David Singleton of Meta Superintelligence Labs characterised the issue as a local configuration problem requiring prior code execution — a framing the security community contested sharply.

Practitioners commenting on the disclosure pointed out that initial local access is routinely trivialised by social engineering vectors such as ClickFix lures, making "requires local access" a weak severity-reduction argument. The harder problem — bypassing TCC without triggering alerts — is exactly what this flaw solves for an attacker at zero marginal cost. The disclosure also arrived shortly after Amazon blocked Muse from its shopping platform for non-compliance with automated agent access policies.

AI Mastery analysis

The Muse flaw is a clear illustration of a principle central to infrastructure isolation as the real AI security standard: model-level guardrails and signed binaries are irrelevant when the configuration surface governing where data flows is writable by any local process. No amount of on-device inference privacy or prompt filtering mitigates a vulnerability that operates at the transport configuration layer, below the model entirely.

Stripping the debug key from a production build closes this specific vector, but it does not address the underlying design choice to deploy an un-sandboxed, deeply privileged agent whose configuration store is accessible to co-resident processes. Any future preference key that governs a network destination, an authentication header, or a backend endpoint selector carries the same class of risk unless the configuration store itself is access-controlled — for example, by restricting writes to the Muse process's own entitlement-bounded container. The absence of a CVE and the "local config problem" framing suggest Meta has signalled a point fix, not a broader architectural remediation. For engineers evaluating agentic desktop clients in enterprise environments, the threat model for a locally installed AI agent with broad TCC grants must account for any co-resident process with user-level execution, not just network-layer adversaries.

Agent permission scope and configuration-store isolation need to be treated as first-class security properties in shipped AI clients. As AI assistants accumulate deeper OS integrations, the attack surface shifts from the model to the infrastructure binding it to the host — precisely the layer that current secure-by-default frameworks were not designed to protect.

Primary source

Un-Mused: How a Single Debug Setting Bypassed macOS Security in Meta's AI Client — InfoQ