Local process can redirect Meta Muse dictation traffic on macOS

Security researcher Patrick Wardle disclosed a local zero-day in Meta’s Muse app for macOS that he says lets an unprivileged process redirect the assistant’s dictation traffic to an attacker-controlled endpoint.

This is not a remote attack by itself: the reported path requires an attacker or malware to already be able to run code as the local Mac user. The concern is that this local foothold could then be amplified through account and device access that a user has granted to Muse.

Wardle’s proof-of-concept repository identifies an undocumented setting called endo_voyager_dictation_endpoint. According to the researcher, a local process can change the setting without special privileges. When a user next activates Muse dictation, dictated prompts can be routed through the substituted endpoint instead of the intended service.

The repository lists several potential effects: capturing dictated audio or prompts, injecting instructions into Muse, stealing Muse authentication material and abusing access a user has already authorized. It says the proof of concept implements a subset of more than 50 commands exposed by Muse and is triggered when the user uses Muse dictation.

Reporting based on Wardle’s testing says Muse sends an authentication token to the redirected endpoint, which could let an attacker control the user’s Muse account. The opened sources do not establish exploitation in the wild, and the research package did not independently run the exploit code.

That risk matters because Muse can act through connected services, a capability described during Muse’s US rollout. Meta’s user guidance says connectors can let Muse see a calendar or write an email, depending on permissions selected by the user. Meta says Muse asks for confirmation before certain actions, including sending an email or making a purchase, though the requirements vary by action and connector.

In its description of Muse’s security architecture, Meta says credentials are isolated from the main agent, connector actions and network traffic pass through a separate permission system, and some operations require human approval. Those materials predate the disclosure and do not address the dictation-endpoint setting identified by Wardle.

The opened sources do not identify an affected-version range, patch, mitigation, security advisory or CVE. Meta had not responded to questions from the two publications by the time their reports were published.