One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor

Summary

Malware already running on a Mac can change a hidden Muse setting, endo_voyager_dictation_endpoint, so dictated prompts go to an attacker-controlled program instead of Meta. Security researcher Patrick Wardle released a proof-of-concept on September 21 showing the attacker can read dictation, inject trusted instructions, and capture the account token to control Muse on any signed-in device. The flaw requires code execution as the logged-in user and does not break into a Mac on its own.

Mitigation

Until Meta confirms a fix, a Mac user can quit or remove Muse, review and revoke the apps and permissions Muse holds, change passwords for the Muse account and connected accounts if the Mac may be compromised, and avoid Muse's voice input. Meta has reportedly pushed a "fix" according to a post on X, but The Hacker News could not confirm what it does and Meta has not published a security advisory.

Related items

• InfoeBay appears to have shut the door on third-party AI agentsSame vendor · The Verge (AI)
• InfoEven Martin Scorsese uses AI for storyboards. Can the art survive?Same vendor · The Guardian Technology
• InfoIntroducing Our Smallest, Most Efficient Model: Muse EmberSame vendor · Simon Willison's Weblog
• InfoApple is racing to make Siri more agenticSame vendor · The Verge (AI)
• InfoSecuring Locally Deployed LLM-RAG Assistants: A Cross-Model and Cross-Lingual Evaluation of Indirect Prompt Injection DefensesSame vendor · OpenAlex (peer-reviewed AI security)