One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor
- ID
- 27164
- Status
- summarized
- Published
- 22 Sep 2026, 2:33 PM
- Fetched
- 22 Sep 2026, 4:07 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.0
- Created
- 22 Sep 2026, 4:08 PM
- Tags
- Audience
- developersai_agent_usersai/ml_learners
What happened
Security researcher Patrick Wardle demonstrated that malware already running on a Mac can hijack Meta's Muse AI assistant by changing an undocumented preference setting (endo_voyager_dictation_endpoint) to redirect dictation audio and text to an attacker-controlled endpoint. From there, an attacker can read dictated prompts, inject trusted instructions, and steal session tokens to control Muse across devices including iPhone. The attack requires existing code execution as the logged-in user—it is not a remote exploit—but because Muse is granted broad access to files, email, messages, and smart-home apps, hijacking it turns the assistant into what Wardle calls 'the ultimate backdoor.'
Why it matters
If you are building or shipping AI agents that hold broad user permissions across files, messaging, or IoT, this is a concrete warning that a single undocumented config endpoint can become a pivot point for session hijacking and cross-device compromise. Audit how your agent stores and validates dictation or input-routing settings, and treat session tokens as high-value secrets—Wardle showed a stolen Muse session token let him control the assistant from a separate device, including location and Bluetooth scans.
Discussion angle
When you give an AI agent sweeping access to a user's digital life, what is your threat model for a compromised host? Wardle's PoC shows the agent becomes a privilege-escalation tool—discuss whether agents should degrade gracefully or require hardware-backed attestation before acting on sensitive actions.