Debug Setting Left Unguarded in Meta's Muse AI Client, Opening Door to Credential Theft

Security researcher Patrick Wardle has disclosed a zero-day vulnerability in Meta's newly released Muse desktop client for macOS that bypasses the operating system's core security model through a single unprotected debugging preference. The flaw undermines Meta's claims that the AI assistant was designed with privacy and security as foundational principles.

The Vulnerability#

The weakness centers on an undocumented configuration setting called endo_voyager_dictation_endpoint. Any unprivileged application or shell script running on the system can modify this parameter without requiring administrator approval or triggering macOS security dialogs. Normally, this setting points to Meta's server for processing voice dictation. By changing it, an attacker can redirect all audio and authentication data to a server they control.

When a user activates voice dictation, Muse transmits raw microphone audio along with the user's valid account authentication token to the configured endpoint. Wardle demonstrated that a proxy server can capture both the credentials and audio while forwarding legitimate requests onward—making the hijacking invisible to the user.

Escalation to Command Injection#

With valid session tokens in hand, an attacker gains access to the assistant's full capabilities. The vulnerability enables prompt injection attacks, where hidden instructions can be appended to voice commands, forcing Muse to perform unauthorized tasks such as extracting local files or accessing WhatsApp message histories without the user's knowledge.

Why the Architecture Failed#

macOS typically restricts applications' access to microphones, files, contacts, and calendars through its Transparency, Consent, and Control framework. However, Muse is designed as an agent capable of interacting deeply with the user's system—accessing applications, email, calendars, and personal files. Users grant it expansive permissions, transforming it into a valuable target. By compromising a single trusted, signed application rather than building custom malware, attackers gain effortless access to all the data and functions the user has already authorized.

Security professionals noted in discussions on Hacker News and Reddit that initial compromise is straightforward—social engineering techniques like can deliver the malicious code. Once deployed, the vulnerability requires no additional exploitation to bypass macOS protections.