Cybersecurity
Hidden Muse setting lets malware redirect dictation
A proof-of-concept from Patrick Wardle showed that malware already running as a Mac user could alter Meta’s Muse dictation path, intercept prompts and tokens, and then steer the assistant.
- Patrick Wardle released a proof-of-concept on 21 September showing that code already running under a Mac user account could change a hidden Muse preference.
- The setting was called endo_voyager_dictation_endpoint and redirected dictation away from Meta to an address the attacker controlled.
- Wardle said the attack could expose dictated text, add instructions that Muse would accept, and capture the token used for the Muse account.
- He said the method required an already compromised Mac session and did not break Meta’s cloud separation design.
- The Hacker News said it could not confirm the reported fix, and Meta had not published a security advisory.
Wardle published a proof of concept on 21 September showing that code already running under the signed-in Mac account could alter a Muse preference and change where dictation was sent. The setting he identified was named endo_voyager_dictation_endpoint.
After that change, Muse sent spoken prompts and transcribed text to a process the attacker controlled on the same machine. Wardle said that let an attacker read the prompt, add extra instructions and capture the account token Muse used.
He said the token could be used to access the user's Muse account history and to direct the assistant on other devices. In his tests on an iPhone, he got Muse to report location, scan nearby Bluetooth devices and list smart-home commands, although it only drafted messages.
Wardle said the attack did not defeat macOS protections against one app reading another app's saved credentials, and it did not show a failure in Meta's cloud separation design. He said he had not told Meta before publishing; later he said the company had issued a fix, while The Hacker News could not verify the change and Meta had not published an advisory.
Named in this story
People
- Patrick Wardle
- security researcher who demonstrated the flaw and described its effects
Companies
- Meta
- company that launched Muse and was said to have issued a fix
Organisations
- The Hacker News
- outlet that could not confirm the reported fix and sought comment from Meta
Products and systems
- Muse
- Meta's personal AI assistant whose Mac app was redirected
- macOS
- operating system whose protections limited the attack to code already running as the user
How the source tells it
Cautious and warning-led, with the strongest drama coming from Wardle’s framing and the article’s immediate user advice.
- alarm The flaw is cast as a route to broad account takeover, with the researcher's warning and the backdoor framing doing the work
- urgency The piece ends with immediate precautions for Mac users and ties them to the absence of a confirmed fix