Meta patched a vulnerability in the Mac client for its Muse AI agent after a security researcher demonstrated that local malware could redirect the app's dictation traffic and take over the user's agent session.
Patrick Wardle published the not-a-mused proof of concept on September 21. The attack changed an undocumented preference that tells the Mac app where to send voice dictation, allowing a local proxy to intercept requests and capture Muse's authentication token.
The flaw turned existing access into leverage
The attack did not remotely compromise an untouched Mac. It required code to already be running as the logged-in user. Once that prerequisite was met, however, the proof of concept could use the captured session to issue commands through Muse.
Wardle demonstrated access to agent functions such as reading chat history, querying connected devices and requesting actions for which Muse already had relevant permission. The practical exposure therefore depended on how much access the user had granted the assistant.
That distinction matters because Meta markets Muse as an agent that can work across email, calendars, files and other services. In its launch materials, Meta says those credentials are stored in a dedicated cloud virtual machine and that a separate Sentinel system reviews outbound actions.
A small local setting crossed the security boundary
The vulnerable setting sat on the Mac side of that architecture. By redirecting the dictation endpoint, malicious code could manipulate the input path before Muse's cloud safeguards evaluated what the user appeared to request.
Meta issued a server-side fix after Wardle's disclosure. The episode does not establish that attackers broadly accessed Muse users' data, and no mass exploitation has been reported. It does show how a desktop client can become the weak link when an AI agent holds broad permissions elsewhere.
