Security researcher Patrick Wardle, founder of the macOS security firm Objective-See, disclosed a zero-day vulnerability in Meta's Muse AI assistant on Sept. 21, publishing a proof-of-concept exploit he called "not-a-mused," according to CyberSecurityNews and Tech Times.
The flaw lives in an undocumented setting called endo_voyager_dictation_endpoint. Any unprivileged process already running on a Mac can change that setting without needing elevated permissions, redirecting Muse's dictation traffic to a server the attacker controls, CyberSecurityNews reported.
Once redirected, an attacker can capture what a user dictates to Muse, inject instructions of their own, and steal the authentication token Muse uses to log back in, giving persistent control of the account. Wardle's demonstrations also pulled data from linked devices and extracted a user's iPhone location through the hijacked assistant, CyberSecurityNews and Tech Times reported.
The bug does not grant remote code execution on its own. It requires an attacker to already have some code running locally, commonly delivered through a ClickFix attack that tricks a user into pasting a command disguised as a routine fix, Tech Times reported. That is a lower bar than remote exploitation, and it matters more here because of what Muse can already reach: files, microphone, camera, location, calendar and other connected services, according to CyberSecurityNews.
Neither outlet reported a public response from Meta as of Sept. 22. Meta runs a bug bounty offering up to $300,000, including $130,000 specifically for demonstrating prompt injection attacks against its AI products, Tech Times reported. Builders who give an agent broad standing permissions are betting that agent's own settings are as hardened as the account those permissions protect. Muse's dictation endpoint wasn't.