How did a hidden setting in Meta’s Muse app let attackers take over the AI agent?

A local process could redirect Muse traffic through an undocumented preference, turning existing Mac access into control over a more privileged assistant.

Researcher Patrick Wardle found that local code on a Mac could change an undocumented Muse redirection setting and send the app’s dictation traffic to an attacker-controlled endpoint, potentially exposing a token used to control the agent. A ClickFix-style scam could supply the first foothold by convincing someone to paste a command into Terminal. Meta has issued a hotfix.

Update Muse and macOS, review the app’s permissions, and never paste commands from a website, chat message, or pop-up into Terminal. The flaw did not let a distant attacker break in with no initial access.