Meta has patched a flaw in the macOS client for its Muse AI assistant after a researcher showed that unprivileged local software could change an internal dictation-server setting. The modification could redirect raw microphone audio and a valid Muse authentication token to an attacker-controlled endpoint without an administrator prompt.
Researcher Patrick Wardle traced the issue to an undocumented preference key used to choose where dictation is processed. His proof of concept used a proxy to capture data while forwarding traffic to Meta, reducing visible signs of interference. He also demonstrated that altered responses could append hidden instructions to voice requests and potentially make the highly privileged assistant access local files or messages.
The risk depends on an attacker already being able to run code as the user, but the assistant may hold permissions that ordinary malware would struggle to obtain through macOS consent controls. That creates an escalation path from limited local execution to the trusted agent’s access.
Meta removed the debugging preference from production builds in a hotfix. The company characterized the problem as a local configuration defect and did not issue a formal security advisory or obtain a CVE identifier. The patch closes this route, but the episode illustrates how broad agent permissions can amplify a relatively simple client-side mistake.