A prominent macOS security researcher has urged Mac users not to install Meta’s new Muse AI assistant, publishing proof-of-concept code for what he described as a zero-day that can turn the app into a ready-made backdoor.
Patrick Wardle, founder of the Objective-See Foundation and author of The Art of Mac Malware, disclosed the flaw in a thread on X accompanied by a working exploit on GitHub.
Wardle called the flaw “not-a-mused”.
The problem centres on an undocumented Muse setting, endo_voyager_dictation_endpoint, which Wardle showed could be changed by any local process without elevated privileges.
Once that endpoint is redirected, the audio a user dictates to Muse is sent to an attacker’s server instead of Meta’s, which the accompanying code says can allow captured prompts, prompt injection into the assistant, and enable theft of its authentication material.
Wardle said the proof of concept is a local attack, one that assumes an attacker can already run code on the machine as the user.
To function, Muse asks for reach across files, microphone, camera, location and calendar, so an attacker who compromises it inherits everything the user has entrusted to it.
A follow-up post extended the concern to linked mobile devices, showing categories of actions that could be requested through a compromised session, including retrieving an iPhone’s location, scanning for nearby Bluetooth devices, and accessing information such as contacts, calendars and reminders.
Amazon on Sunday began blocking Muse from shopping on amazon.com, according to Ars Technica.