Muse Mac PoC Exposes a Local Hijack Path
A public proof of concept redirects Meta's Muse dictation channel and captures credentials, but the attack first requires code execution as the logged-in Mac user.
The 60-second version
A public PoC redirects Muse for Mac's dictation endpoint through a local proxy that can observe prompts and capture authentication material.
Key points
- The attacker must already execute code as the logged-in Mac user; this is not a demonstrated zero-click remote compromise.
- The risk is amplification because Muse is intended to access communication, calendars, commerce and a persistent cloud browser.
- The repository is technical evidence, while the former Meta employee's quoted opinion is context rather than proof.
- No public Meta advisory was found confirming affected versions, patch status or exploitation in the wild.
Verdict. Pause dictation and reduce permissions until Meta publishes verifiable remediation details; if local malware is suspected, investigate the Mac rather than only uninstalling Muse.
The findingWhat the proof of concept changes
Security researcher Patrick Wardle published not-a-mused, a macOS proof of concept that changes an undocumented Muse preference named `endo_voyager_dictation_endpoint`. The code redirects Muse's dictation connection to a local WebSocket proxy and restarts the app.
When the user next dictates a prompt, the proxy sits between Muse and Meta's legitimate upstream service. The repository says this can expose transcripts and an `ABRA` authentication token, creating paths to prompt capture, prompt injection, credential theft, and use of capabilities already trusted by the account.
Risk boundarySerious amplification, not remote magic
The attack is local. Code must already be running as the logged-in Mac user. The PoC does not show an internet attacker compromising a clean Mac merely by knowing that Muse is installed.
The security concern is amplification. Ordinary local malware may have limited reach, while an agent is deliberately trusted with accounts, data and actions. If malware can borrow the agent's session or input channel, it may inherit part of that trust.
| What is demonstrated | A local-user process can rewrite the dictation endpoint, proxy traffic and attempt to capture Muse authentication material. |
|---|---|
| What is not demonstrated | A zero-click remote infection, exploitation at scale, or compromise of every Muse user. |
| Why the impact may grow | Muse is designed to act across communication, commerce, calendars and a persistent cloud browser environment. |
| What remains unknown | Affected versions, server-side mitigations, patch availability and observed abuse in the wild. |
EvidenceSeparate the code from the commentary
The widely shared International Cyber Digest post accurately links to Wardle's repository and summarizes the local redirection claim. It also cites a recently departed Meta AI security manager saying he would not personally use the product because of security and privacy concerns.
That opinion is not proof of the exploit. The attached screenshot redacts the speaker's identity and supplies no affected-version or remediation details. The repository and its code are the technical evidence; Meta's official Muse page establishes the product's intended access and capabilities.
ResponseWhat users and security teams should do
- Pause Mac dictation until Meta documents whether the current build is affected and how it is fixed.
- Update Muse and macOS, then review Files, Mail, Messages, Calendar, Notes, camera and accessibility permissions; remove anything not required.
- Treat suspected local malware as the primary incident. Investigate login items and recent installs, and rotate relevant credentials from a clean device.
- For enterprise pilots, test whether agent endpoints and preferences are user-writable, inventory tokens, and map every command the agent can invoke.
An AI agent becomes a high-value target because its usefulness is built from accumulated trust.
The operational conclusion is simple: this PoC does not eliminate the need for an initial Mac compromise, but it shows why that foothold can become more valuable when a broadly connected agent is present. Wait for a concrete Meta advisory before treating the issue as fixed.