Researcher discloses Meta Muse macOS zero-day

macOS security researcher Patrick Wardle disclosed a zero-day in Meta’s Muse assistant that lets any local app or terminal command rewrite an undocumented dictation-endpoint setting, redirect voice prompts to an attacker server, and obtain the token that controls the Muse account — including leverage over linked devices.

SAFETY desk — personal AI agents with root-like access to your life raise the cost of a single local bug from “steal one app” to “own the assistant that already has the keys.”

What the flaw is, at the level Ars reports. Muse keeps a list of settings that are not in the public menus. Any app already on the Mac, or any code the person runs, can change those settings, even when that app lacks the special macOS permissions Apple uses to guard the microphone, the camera, and files. Most of the settings are ordinary. Ars gives dark mode as the harmless example. One setting is not harmless. It holds the server address where Muse sends speech to be turned into text. That job is called transcription, or dictation. The normal address belongs to Meta. Someone who can change it can point the address at a server they control. This path starts with code already running on the Mac. It is not a remote break-in of a machine where nothing local has run.

What Ars says happens after that address changes. Once the person dictates, the other server receives the token that signs the user in to Muse. A token, here, is the credential that says this session may act as that Muse account. Ars says that token gives complete control of the account. The leverage is the access the person already granted the assistant, not a new remote hole. Ars lists that access as files on the Mac, the microphone and camera, and connections such as WhatsApp, email, calendar, and social accounts. Controlling the account is also the stake the disclosure describes for devices already tied to that same Muse login. This filing does not list device commands.

Wardle’s line, quoted by Ars: “We can manipulate the agent and leverage its privileges to do whatever we want.” He told Ars that an attacker can use the assistant itself instead of writing a full Mac stealer. A stealer is malware whose job is to copy secrets off the computer. He also told Ars he had built demonstrations that do things such as writing files and taking pictures, in many cases with no alert even a careful user would see. Outcomes are not steps. This filing does not include a command, a setting name, or a reproduction recipe.

How the first foothold can arrive, still high level. Ars says a ClickFix-style lure can be enough. ClickFix is a social-engineering trick: a page or a message talks a person into running something on their own computer. It is not an attack that fires by itself when someone only looks at a page. The lure and the command stay out of this card.

Meta did not answer. Ars says Meta representatives did not answer emailed questions. Silence is not a confirmation, and it is not a denial this desk can quote.

Wardle published a proof-of-concept repository on GitHub under the name not-a-mused. A proof of concept is a demonstration that a flaw is real. This filing cites that repository as his disclosure vehicle. It does not reprint what is inside it. Ars describes Wardle as the founder of the Objective-See Foundation, a nonprofit focused on macOS security, a former employee of NASA and the National Security Agency, and the author of The Art of Mac Malware. He told Ars he plans to discuss the vulnerability, and other threats to AI assistants, at the Objective by the Sea conference in November.

One design point Wardle gave Ars, still not a how-to. Muse sends dictation to the cloud, where Meta can log it, instead of using the on-device transcription macOS already provides for apps. He said that cloud choice is what made a redirected address possible. He also said letting any local app change the whole hidden list looks like a door meant for harmless interface options, not for the server that receives someone’s speech. They explain the shape of the flaw. They are not instructions.

That is a retailer shutting an agent out of a store. Ars notes the block began around the same day. It is a different story. Ars does not establish that. A finished patch would be a Meta note or a software update. None is on this card.

Plain English for the rest of the card: zero-day = a flaw still open when it is disclosed. Muse = Meta’s personal AI assistant for macOS. AI agent = software that can take steps, not only chat. dictation / transcription = turning speech into text. endpoint = the server address that receives that speech. token = the credential that lets a session act as the Muse account. ClickFix = a lure that gets a person to run something on their own computer. stealer = malware that copies secrets. local code = an app or a command already running on that Mac. This filing is Wardle’s disclosure as Ars reported it. It is not a patch, and it is not the Amazon shopping block.