Meta launched its AI assistant app Muse earlier this month and highlighted its security. The company relied on Muse Secure VM for protection. Meta stated that each person stays in control of their Muse and decides how much access it gets. This statement echoed previous claims about the privacy of its data gathering business.
Security researcher Patrick Wardle found that this security claim is overstated. Wardle is the founder of the nonprofit Objective-See. He built a proof-of-concept named not-a-mused. He describes this as a local zero-day in the Muse macOS app. The vulnerability lets an unprivileged local process redirect dictation traffic. It can also potentially abuse access granted to the app.
Wardle explained in the project repository that Muse has an undocumented setting. The setting is called endo_voyager_dictation_endpoint. An attacker running code locally can modify this setting without special privileges. This action redirects dictation traffic to an endpoint controlled by the attacker. It could expose dictated audio and prompts sent to the backend AI model. The flaw enables prompt injection, authentication material theft, and abuse of user-granted access.
The vulnerability does not affect remote attackers. It requires the ability to run local code. Wardle notes the main concern is that the vulnerability gives local malware far broader access than normal. It functions as a privilege escalation vulnerability.
Wardle compared the situation to living in an apartment building during a phone interview. He stated that just because a bad neighbor moves in, that neighbor does not automatically get access to all apartments. He praised Apple for its Transparency, Consent, and Control framework and privilege separation on macOS. His concern is that AI apps undo these barriers because they request extensive data and tool access.
Wardle stated that AI apps are super convenient and empowering. He added that they have so much access when configured for usefulness that they could basically do anything on a computer. They become a single point of failure that breaks operating system security controls.
Wardle questioned why AI companies do not use their bug-finding models against their own apps. He asked if security is not a priority for their own applications. He noted that endpoint detection and response software has improved on macOS due to code signing. However, broad permissions for AI agents prevent EDR products from knowing the command source.
Wardle said these agents need access to be useful. He stated that AI app makers lack a sense of responsibility for the access their apps seek. He noted that Apple provides an on-device local dictation API. If Meta used that API, the vulnerability would not exist. He suggested Meta avoided the Apple service to gain access to that data.
Wardle concluded that greediness for user data opens the door and increases the attack surface. He stated that AI companies race for what is next while user privacy and security are not priorities.
