Meta patches Muse macOS bug that let local apps hijack dictation traffic

A silent hotfix closes a flaw that turned Muse’s trusted macOS agent into a conduit for audio and token theft by any local process.

Security researcher Patrick Wardle disclosed a zero‑day in Meta’s new Muse macOS desktop client that let any local, unprivileged process redirect its dictation traffic to an attacker‑controlled server by modifying an undocumented debug configuration key. Because Muse runs as a highly trusted agent with broad permissions to files, calendars, email, audio, and other data, this misconfiguration effectively let commodity malware piggyback on Muse’s privileges instead of needing its own full exploit chain. The attack path exposed both raw microphone audio and valid Muse authentication tokens, enabling prompt‑injection style abuse to run arbitrary background commands such as document or WhatsApp data exfiltration. Wardle released a proof‑of‑concept called not-a-mused, and the disclosure followed Amazon’s recent decision to block Muse from its shopping platform over automated agent policy violations. Meta responded with a silent hotfix that removed the debug preference from production builds and characterized the issue as a local configuration problem not warranting a CVE, a position many security practitioners publicly disputed.