‘I’d Never Use Muse’: Meta Security Expert Reacts to Zero-Day Turning AI Into an ‘Ultimate Backdoor’

When prominent macOS security researcher Patrick Wardle urged users not to install Meta's new Muse AI assistant, he warned that a newly disclosed flaw could turn the app into a backdoor.

Patrick Wardle, founder of the Objective-See Foundation and author of The Art of Mac Malware, revealed the security flaw in an X post paired with proof-of-concept exploit code on GitHub.

'Please don't install,' he wrote. 'It's trivial to turn Muse into the ultimate backdoor.'

He called the flaw 'not-a-mused'.

A Simple Exploit Can Redirect Voice Notes

Any local process can alter an undocumented setting in Muse without needing elevated privileges, known as endo_voyager_dictation_endpoint, according to Wardle's proof of concept.

Once hackers redirect this path, the audio and prompts a user dictates to Muse can be sent to an attacker-controlled server instead of Meta's. According to the included code, this setup can capture dictated prompts, enable prompt injection into Muse and allow the theft of Muse authentication material.

However, the flaw is a local attack rather than a remote vulnerability. An attacker must already be able to execute code on the Mac as the local user.

Once the malicious endpoint has been configured, triggering the proof of concept requires the user to click Muse's microphone button and dictate a prompt normally.

Muse's Powerful Permissions Raise the Stakes

Wardle noted that this proof of concept relies on a local attack, which depends on an adversary already running code on the computer under the user's account. He argued that Muse is an unusually valuable target because an assistant designed to manage a Mac can hold far broader access than typical malware would ordinarily have.

Because Muse can be granted access to files, the microphone, camera, location and calendar, a successful takeover could give an attacker access to resources the user has entrusted to the assistant. 'Muse's access can potentially become the attacker's access,' the exploit's documentation stated.

The Threat Extends to Connected Devices

A subsequent update extended the concern to linked mobile devices, showing what could be requested through a compromised session, including retrieving an iPhone's location, scanning for nearby Bluetooth devices and accessing information such as contacts, calendars and reminders.

Messaging, by contrast, only prepared a draft rather than sending it silently.

Wardle said he would share further details and other vulnerabilities at the upcoming Objective by the Sea security conference in November. Meta has emphasised Muse's security, with CEO Mark Zuckerberg promoting the AI assistant as a personal agent that works around the clock on a user's behalf.

Meta's Security Defences Face Scrutiny

Meta says Muse uses isolated execution, least-privilege access and a dedicated security layer called Sentinel, which it describes as the sole authority for connector actions and network egress.

Earlier this year, the viral OpenClaw, then known as Clawdbot, prompted warnings from companies and security researchers over the risks of giving an AI agent broad access to a user's computer, files and accounts.

As major tech firms race to embed autonomous agents deeper into personal operating systems, the Muse vulnerability highlights the security risks that can arise when AI assistants are given broad access to devices, accounts and personal data. The flaw also shows how a compromise that begins with malicious code running locally could potentially extend to the wider permissions and connected devices entrusted to an AI agent.