Full Report
Ad biz promises users control while bug could expose voice prompts
Analysis Summary
# Vulnerability: Meta Muse AI App Dictation Traffic Redirection
## CVE Details
- **CVE ID**: Pending (Reported as a local zero-day)
- **CVSS Score**: N/A (Estimated Medium/High for local privilege escalation)
- **CWE**: CWE-15: External Control of System or Configuration Setting
## Affected Systems
- **Products**: Meta Muse AI assistant app for macOS
- **Versions**: Initial launch versions (Current as of September 2026)
- **Configurations**: Systems where the Muse app has been granted broad TCC (Transparency, Consent, and Control) permissions by the user.
## Vulnerability Description
The Meta Muse macOS application contains an undocumented configuration setting labeled `endo_voyager_dictation_endpoint`. An unprivileged local process can modify this setting to redirect the app's dictation traffic. Because the Muse app typically requires extensive system permissions to function as an AI agent, this flaw allows an attacker to bypass macOS security barriers (TCC) by piggybacking on the app's trusted status.
## Exploitation
- **Status**: PoC available ("not-a-mused")
- **Complexity**: Low (Requires local execution but no special privileges)
- **Attack Vector**: Local
## Impact
- **Confidentiality**: **High** (Exposure of dictated audio, AI prompts, and potentially authentication material)
- **Integrity**: **High** (Potential for prompt injection and unauthorized command execution via the AI agent)
- **Availability**: **Low** (Primary impact is data theft and unauthorized access)
## Remediation
### Patches
- **Meta Muse for macOS**: No official patch was reported at the time of the disclosure. Users should check for updates via official Meta channels.
### Workarounds
- **Restrict Permissions**: Revoke sensitive TCC permissions (Microphone, Accessibility, Full Disk Access) for the Muse app if not strictly necessary.
- **Use System Dictation**: Utilize native macOS on-device dictation instead of third-party AI dictation tools where possible.
- **App Sandbox**: Ensure the application is running with the minimum necessary privileges.
## Detection
- **Indicators of Compromise**:
- Unauthorized modifications to Muse application configuration files or plists.
- Outbound network traffic from the Muse process directed to unknown or suspicious IP addresses/endpoints instead of official Meta backends.
- **Detection Methods and Tools**:
- EDR (Endpoint Detection and Response) monitoring for modifications to the `endo_voyager_dictation_endpoint` string.
- Patrick Wardle’s **not-a-mused** PoC can be used by researchers to verify the flaw's presence.
## References
- **Objective-See (Patrick Wardle)**: hxxps[://]github[.]com/pwardle/not-a-mused
- **Security Research Blog**: hxxps[://]objective-see[.]org/
- **Original Report**: hxxps[://]www[.]theregister[.]com/2026/09/21/meta_muse_ai_flaw/