Meta Muse AI app flaw lets local malware redirect dictation traffic

The Meta Muse AI app for macOS has been found to have a flaw that could allow local malware to gain more access than expected. Security researcher Patrick Wardle has developed a proof-of-concept called not-a-mused to demonstrate the vulnerability. The issue stems from an undocumented setting called endo_voyager_dictation_endpoint, which an attacker can manipulate to redirect dictation traffic away from the intended destination.

This could lead to prompt injection, theft of authentication material, and abuse of the user's granted access. The flaw requires local code execution, making it a privilege escalation vulnerability rather than a concern for remote attackers. Wardle compared the situation to living in an apartment building where a bad neighbor could gain access to all units, highlighting the broad access granted to local malware.

Apple's Transparency, Consent, and Control (TCC) framework and privilege separation have helped manage sensitive data access, but Wardle expressed concern that AI apps often require extensive permissions, potentially breaking operating system security controls. He questioned whether AI companies are prioritizing security, suggesting that endpoint detection and response (EDR) software struggles to distinguish between legitimate commands and those from attackers.

Wardle recommended that Meta use Apple's on-device local dictation API instead of its own service to mitigate the risk, citing a potential data privacy issue. Meta declined to comment on the matter.