Thirteen days after Meta launched Muse, and four days after it shipped the Mac client, Patrick Wardle showed that any program running on a Mac can quietly hijack the personal agent, steal the token that authenticates it, and use that foothold to reach the owner’s iPhone. In a three-part demonstration posted to X on September 21, the Objective-See Foundation founder pivoted from a compromised Mac session to Muse’s device inventory, pulled a linked iPhone’s location in Barcelona, and started a Bluetooth Low Energy scan on the phone. None of it, he said, was visible to the user.
The flaw itself is almost embarrassingly simple. Muse for Mac carries an undocumented setting called endo_voyager_dictation_endpoint that tells the client where to send dictated audio. Wardle found that any unprivileged local process, including a plain terminal command, can flip it, regardless of the permissions macOS has granted that process. Redirect the endpoint and the next time the user taps the microphone and speaks a prompt, the audio and the credentials that ride along with it arrive at an attacker-controlled server instead of Meta’s. From there, Wardle says, an attacker can inject instructions into the assistant and reuse the captured authentication material against the account.
Wardle published proof-of-concept code under the name not-a-mused, and he was blunt about what people should do in the meantime. “Please don’t install,” he wrote on X. “It’s trivial to turn Muse into the ultimate backdoor.”
From one Mac to every linked device
The second and third parts of the demonstration are what turned a local dictation bug into something larger. Once the stolen token is in hand, Wardle’s code queries Muse’s account API for the user’s device inventory. Each connected device advertises the commands it supports, a device identifier, and whether it is currently online. His code picks an online device and directs Muse to run one of its advertised commands. Wardle says Muse exposes more than 50 such commands; his public code implements only a subset.
His X thread focused on the iPhone. “Once a Mac is exploited, you can interact with any of the user’s connected devices also running Muse,” he wrote, describing how a compromised session can silently task a linked iOS client. The demonstration retrieved the phone’s location, scanned for nearby Bluetooth devices, and reached toward contacts, calendars and reminders. A messaging action, he noted, only prepared a draft rather than sending it silently.
The prerequisite matters. This is not a remote, drive-by compromise of an untouched Mac. An attacker must already be able to run code under the user’s account. What Wardle is describing is access amplification, effectively a privilege escalation: ordinary malware arrives with limited reach, but by targeting Muse it inherits everything the user entrusted to the agent, across devices. In a phone interview with The Register, Wardle likened it to an apartment building. “Just because a bad neighbor moves in doesn’t mean that that neighbor automatically has access to all the apartments,” he said.
Why it matters
Meta made much of Muse’s security at launch. The company’s architecture centers on a Muse Secure VM, a dedicated cloud computer that stores the agent’s data and connected credentials, plus a service called Sentinel that is supposed to be the sole authority for connector actions and network egress. Meta says the agent never receives raw passwords or tokens. Wardle’s finding sidesteps all of that, because it targets a different boundary: the software installed on the user’s own computer and the trust that binds that client to the wider account. Cloud isolation offers little protection when the local client can be redirected before its traffic ever reaches the protected environment.
That is the uncomfortable lesson for every personal agent, not just Muse. Apple built the Transparency, Consent and Control framework precisely to stop an ordinary process from reading location, microphone or camera data without approval. But an agent asks for all of that access to be useful, and endpoint detection tools cannot easily tell whether a command originates from the user, the agent, or an attacker riding the agent. “They’re super convenient and super empowering,” Wardle said of AI apps. “But they have so much access if you configure them to be useful. They basically could do anything on your computer.” He argued that Meta could have used Apple’s on-device dictation and avoided the exposed endpoint entirely, suggesting the company’s appetite for user data widened the attack surface.
The stakes are amplified by Muse’s reach. It launched September 8 and is the No. 1 free iPhone app in the United States; Shopify wired it into Shop Pay the same day, and Meta advertised the Mac client’s access to Files, Messages, Calendar, Notes and Mail. Meta opened a bug bounty at launch offering up to $300,000 for qualifying reports, but its published threat model leaned heavily on prompt injection and cloud attacks rather than the compromised-client scenario Wardle demonstrated. Meta did not immediately respond to The Register’s request for comment.
What to watch
Wardle says he is holding back further detail, and additional bugs, for the Objective by the Sea conference in November, so the public picture is likely incomplete. The immediate questions are whether Meta ships a fix that locks down the dictation endpoint and hardens the client-to-account trust, whether it broadens its bounty scope to cover compromised-endpoint attacks, and whether other agent vendors racing similar products quietly check their own clients for the same class of flaw before someone else does.
“Please don’t install. It’s trivial to turn Muse into the ultimate backdoor.”— Patrick Wardle, Founder, Objective-See Foundation