Among the undocumented settings that any locally installed macOS app can flip inside Meta's Muse assistant, most are cosmetic β dark mode and similar. One is not. It controls the server address where dictated speech gets transcribed, and changing it redirects the authentication token that grants full control of a user's Muse account to whoever is listening. Security researcher Patrick Wardle disclosed the zero-day, first reported by Ars Technica, on September 21.
Key takeaways
- Any local app or terminal command can alter Muse's undocumented settings regardless of the macOS permissions it holds, including the transcription endpoint.
- Redirecting that endpoint delivers the account token to an attacker, who can then proxy prompts and issue commands with the assistant's own privileges.
- Exploitation does not require a pre-compromised machine β Wardle showed a variation of the ClickFix social-engineering lure is sufficient.
How the exploit chain works
The relevant design decision is that Muse sends dictation to Meta's cloud for transcription rather than keeping it on the device, even though macOS has offered local speech processing for years. That creates a network endpoint, and the endpoint is user-writable by any process.
An attacker who repoints it can sit between the user and Meta as a proxy. Once a voice prompt passes through, the attacker's server appends an instruction of its own β Wardle's example was exfiltrating an archive of WhatsApp messages. Because the token travels to the malicious server alongside the prompt, access does not end when the session does.
Wardle told Ars he built working proofs of concept that wrote files to disk and captured photos, in many cases without any signal an attentive user would notice. Rather than authoring a comprehensive macOS stealer, he said, an attacker can simply borrow the assistant's privileges.
Why the permission model matters here
To function, Muse requires authentication to a user's accounts plus broad macOS entitlements: disk writes, microphone, camera, location and calendar access. Apple spent years building those consent gates precisely because installed apps and terminal commands should not reach those resources freely. An AI assistant granted all of them becomes a single high-value target, and a flaw in it inherits every permission the user approved.
The standard rebuttal β that all bets are off once a device is compromised β does not apply cleanly. ClickFix, the technique Wardle adapted, works on uncompromised machines by convincing people to paste a command themselves.
Meta's position, and Amazon's
Mark Zuckerberg has promoted Muse as built from the ground up for privacy and security, and Meta published two posts in as many weeks describing the design work behind that claim. The company did not respond to emailed questions from Ars about the vulnerability.
Separately, roughly twelve hours before the disclosure, Amazon began refusing Muse traffic on its storefront, telling users the assistant was an unauthorized AI agent in violation of its Conditions of Use. Amazon said third-party applications that purchase on a customer's behalf should operate openly and respect a service provider's decision about whether to participate, comparing the arrangement to delivery apps and online travel agencies, and asked Meta to remove Amazon from the experience.
What comes next
Wardle β who founded the Objective-See Foundation, wrote The Art of Mac Malware series, and previously worked at NASA and the National Security Agency β plans to present the vulnerability and related assistant threats at the Objective by the Sea conference in November. No fix had been announced at the time of disclosure.
The broader lesson is not specific to Meta. An agent that asks for inbox, calendar and payment access is asking to be trusted with the whole device, and a single writable setting is enough to undo that trust.
FAQ
Does the Muse zero-day require malware on the machine first?
No. Wardle demonstrated that a variation of the ClickFix technique, which tricks a user into running a command themselves, is enough. Any local process can then change the setting, regardless of its macOS permissions.
Has Meta patched the vulnerability?
Not as of the disclosure. Meta did not answer questions about the flaw, and no fix or mitigation had been published. Wardle intends to detail the issue at a security conference in November.
Why did Amazon block Muse?
Amazon said Muse was operating as an unauthorized agent in breach of its Conditions of Use, and argued that agents making purchases on a customer's behalf should do so openly and with the retailer's consent. The block began about twelve hours before the zero-day became public.
