Meta Muse Zero-Day Let Local Apps Hijack the AI Agent
A voice assistant on Mac could become someone else’s microphone and remote control at once: a zero-day found in the AI agent Muse lets an ordinary local process intercept the user’s dictation and make use of access already granted to the agent.
The problem was discovered by macOS security specialist Patrick Wardle. The vulnerability affects Meta’s Muse client for macOS. The application works with files, the browser, messages, the calendar, and other computer resources, and the agent itself can perform actions on the user’s behalf. It is precisely this broad set of privileges that turns a comparatively simple local bug into a serious problem for AI agents.
An Undocumented Dictation Endpoint
The cause hides in the undocumented parameter endo_voyager_dictation_endpoint. This parameter sets the address of the server to which Muse sends voice-input data. Any program running under the user’s account can change the value without any additional privileges and redirect the traffic to a node controlled by an attacker.
Once the address is substituted, the attacker gains the ability to intercept voice requests and their transcription. This is not a matter of constant background eavesdropping on a room: the published proof of concept triggers when the user turns on Muse’s microphone and dictates a request. Yet the same channel allows the attacker to inject their own instructions, turning ordinary prompt injection into an attack conducted through a trusted application.
Stealing the ABRA Authentication Token
More dangerous still appears the interception of the ABRA authentication token. Wardle’s code extracts it from the redirected connection, after which it can reach the infrastructure of the Muse account and obtain information about the allocated cloud virtual machine. In effect, the malicious program gains the ability to act through an already-authenticated agent, rather than having to bypass each of macOS’s defenses on its own.
The proof of concept implements only part of the more than 50 commands available to Muse. The code can retrieve chat history, address the agent’s environment, write files, and trigger other actions. Some capabilities depend on permissions the user has already granted the application, such as camera access. A similar threat model has already surfaced in other agentic systems, where user-granted permissions ceased to be a reliable security boundary.
A Local Attack, Not a Remote One
The zero-day itself does not allow a clean Mac to be hacked remotely. The attacker must first achieve the execution of their own code under the user’s account, for instance through malware or social engineering. Wardle regards the vulnerability as an amplifier of access already obtained: a low-privileged process gains the capabilities of an application the person has voluntarily entrusted with far more data. A similar risk has appeared before in cases where Meta’s agents stepped outside their originally intended script.
Meta’s Response
After the research was published, Muse lead David Singleton reported that Meta had released an emergency fix for the Mac client. The company also stressed the local nature of the attack. Muse users on macOS would do well to ensure they have the current version of the app installed, and, if compromise is suspected, to review the granted permissions and connected services.
Wardle published the not-a-mused code and separately warns that the chief risk concerns more than voice interception alone. The more files, accounts, and devices a user connects to a personal agent, the more valuable that agent itself becomes as an intermediate target for malware.
A Pattern Across Agentic Systems
A similar problem was recently found in NVIDIA NemoClaw: a malicious webpage could hijack control of the agent, after which resources the user had authorized turned into tools for the attacker.
Another fresh example affected the Kiro IDE. A vulnerability there allowed an AI agent to send working files to an external server even before the user had confirmed a settings change. Both cases reveal the same weakness in today’s agents: the interface may promise control, even as part of the action already occurs outside the familiar permissions model.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
