A single configuration key in Meta's macOS desktop client for Muse let any unprivileged local process hijack the AI assistant's network destination and steal both microphone audio and account credentials, according to security researcher Patrick Wardle, founder of the Objective-See Foundation, as reported by InfoQ. The flaw remains without an official CVE designation because Meta did not release a formal security advisory or coordinate with a CVE Numbering Authority, InfoQ reports.
The vulnerability lives in an undocumented preference key named endo_voyager_dictation_endpoint. Under normal operation, that key tells the client which cloud endpoint should receive microphone audio for voice dictation and return transcriptions. InfoQ reports that local processes and arbitrary scripts running in an unprivileged user context can overwrite this value without elevated administrative rights and without triggering a macOS authorization prompt — meaning no sandbox escape or privilege escalation is required, just the ability to write a config file.
Once that endpoint is redirected, the client sends both raw microphone audio and the valid authentication token tied to the victim's Muse account to a server the attacker controls, per InfoQ's account of Wardle's disclosure. Wardle demonstrated a proxy that captures the audio and tokens while quietly forwarding legitimate traffic back to Meta's real servers, so the victim sees nothing wrong. With a stolen session token and control of the command pipeline, an attacker can also perform prompt injection by appending hidden instructions to voice requests, pushing the assistant into unauthorized background tasks such as exfiltrating local documents or WhatsApp message histories, InfoQ reports. Wardle published a proof-of-concept named not-a-mused showing execution of numerous commands through the compromised agent.
The architectural problem, as InfoQ frames it, is access amplification. macOS uses its Transparency, Consent, and Control (TCC) framework to gate application access to microphones, files, contacts and calendars, and users had granted Muse broad authorizations precisely because it acts as an agent across applications, calendars, email and files. Wardle noted that the exploit lets an attacker manipulate the trusted, signed agent directly rather than build a standalone infostealer — the agent's own permissions become the attack surface. A former Meta AI security engineering manager, cited by InfoQ, said they would avoid using the software given the risks of that deep integration.
Meta's fix, per InfoQ, was to strip the internal debugging preference key from production client builds, preventing local modification of the dictation destination — treated internally as a configuration defect rather than a vulnerability requiring formal CVE assignment. David Singleton of Meta Superintelligence Labs is reported to have framed the issue as a local configuration problem requiring prior code execution. InfoQ reports that the security community pushed back on that framing, noting in reactions on the disclosure post that initial access is trivially achieved through social-engineering lures like ClickFix, even though bypassing TCC is traditionally difficult — meaning the caveat that the flaw requires prior code execution undersells the real-world attack path.
InfoQ also notes that observers on Hacker News and Reddit characterized the design as bundling device cross-sync, full disk permissions, audio streams and private chat histories into an un-sandboxed, signed agent with a modifiable debug endpoint — giving commodity malware, in their framing, a zero-effort conduit around platform protections without raising operational alerts. The disclosure landed shortly after Amazon moved to block Muse from its shopping platform over non-compliance with automated agent access policies, InfoQ reports, though no connection between the two events is drawn in the source.
No CVSS score, latency figure or affected-user count appears in InfoQ's reporting — the operational fact here is structural, not statistical: a debug-only config key shipped in a production build, writable by any unprivileged process, sat upstream of a trusted agent's full TCC grant. For teams shipping native AI desktop clients, the lesson is procedural, not technical: debug flags and internal endpoint overrides need the same pre-release audit as production entitlements, because once an agent inherits broad OS permissions, any writable configuration path becomes a permission bypass, not just a debugging convenience.