Flaw in Meta's Muse AI App Could Let Local Malware Hijack Voice Data

Meta launched its Muse AI assistant app earlier this month, promising users control over what data the app can access. However, security researcher Patrick Wardle of Objective-See has found that this control may not be as strong as advertised. He created a proof-of-concept, called not-a-mused, showing that an unprivileged local process on a Mac can modify an undocumented Muse setting to redirect the app's dictation traffic to a server controlled by an attacker.

This means that if malware is already running on a victim's computer, even without special privileges, it could intercept voice prompts and dictated audio sent to Muse's backend AI model. Wardle warns this could enable prompt injection attacks, theft of authentication data, and misuse of whatever permissions the user has granted the app. Importantly, the flaw cannot be exploited remotely; it requires an attacker to already have code running locally, making it a privilege escalation issue rather than a remote takeover risk.

Wardle points to a broader concern: AI assistant apps often require sweeping access to a device's data and functions to be useful, which can undermine strong operating system protections like Apple's Transparency, Consent, and Control framework. As a result, these apps can become a single point of failure that bypasses long-standing security safeguards.