Overview
Security researcher Patrick Wardle published a proof-of-concept on September 21, 2026, demonstrating that Meta’s newly launched Muse AI assistant for macOS can be silently converted into an attacker-controlled backdoor by modifying a single, undocumented application preference. The vulnerability does not break into macOS independently, but it weaponises the broad delegated access that users willingly grant to Muse — including files, email, messages, calendar, shopping, and smart-home systems — making the attack surface proportional to the trust the victim has placed in the assistant.
Technical Analysis
The core of the issue is an undocumented macOS preferences key, endo_voyager_dictation_endpoint, stored in the Muse app’s preferences domain. Any process running as the logged-in user can write to this key without requiring elevated permissions or any additional entitlements — a consequence of macOS’s permissive user-level preferences model.
Once the key is overwritten to point at an attacker-controlled server, the following chain occurs:
- Dictation interception: When the victim taps the microphone and speaks a prompt, both the raw audio and its transcription are routed to the attacker’s server rather than to Meta’s backend.
- Prompt injection: The attacker’s proxy can append or replace instructions before forwarding the request to Meta, causing Muse to execute commands the user never issued.
- Token harvesting: Muse includes its authentication token in the redirected dictation request. The attacker captures this token and can use it to authenticate to Muse’s API independently, gaining persistent access to the user’s Muse account and its full chat history.
- Cross-device lateral movement: Because a Muse account supports multiple linked devices, the stolen token allows the attacker to direct Muse on the victim’s iPhone — demonstrated by Wardle to retrieve GPS location, run a Bluetooth device scan, and enumerate available smart-home commands.
The initial foothold required for local code execution can be achieved without any file download via a ClickFix social-engineering lure, which tricks the user into pasting and running a single terminal command.
Notably, macOS security tooling may not flag the activity because all commands originate from Muse itself — a legitimately signed, notarised application.
Framework Mapping
- AML.T0081 (Modify AI Agent Configuration): Direct manipulation of the dictation endpoint preference is the primary attack vector.
- AML.T0083 / AML.T0098 (Credentials from AI Agent Configuration / Tool Credential Harvesting): The session token is exfiltrated as a side-effect of the redirected request.
- AML.T0051 (LLM Prompt Injection): The attacker injects malicious instructions into the proxied dictation stream.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation): Location data, Bluetooth scans, and smart-home capabilities are exfiltrated through Muse’s own legitimate tool integrations.
- LLM08 (Excessive Agency): Muse’s broad, delegated access across multiple device types and services is the amplifier that makes the token theft critically impactful.
Impact Assessment
The attack affects any macOS user running Meta Muse who has granted it access to personal data or device integrations. The severity is elevated by three factors: the undocumented nature of the exploited preference (no user-visible indicator), the absence of additional permission prompts, and the cross-device scope of token reuse. Security software is unlikely to detect the activity because it originates from a trusted, signed process.
Mitigation & Recommendations
- Do not install Meta Muse until Meta issues a fix that restricts write access to the dictation endpoint preference or removes the undocumented key entirely.
- Revoke existing Muse permissions for email, files, calendar, and smart-home integrations via macOS System Settings > Privacy & Security if Muse is already installed.
- Monitor macOS user defaults for unexpected writes to
endo_voyager_dictation_endpointusing endpoint detection tooling. - Educate users on ClickFix-style social engineering — no legitimate service requires users to paste commands into Terminal.
- Meta should deprecate or cryptographically sign the dictation endpoint preference to prevent unauthorised modification.