A researcher's proof of concept shows malware already on a Mac can quietly redirect Meta's AI assistant and ride along on the access its owner already granted it.
According to The Hacker News, security researcher Patrick Wardle released a proof of concept showing that malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app. The attack works by changing a hidden setting, stored in the app's preferences as endo_voyager_dictation_endpoint, so that when a user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. Any program already running as the logged in user can point that setting at an address the attacker controls, without needing extra permissions.
Because Muse still sends its own access token along with the redirected dictation, the attacker gets the assistant to act with whatever access it already has, and the flaw only works once an attacker can already run code as that user. Wardle noted that security software may not flag the activity, since the commands come from Muse, a normal signed app, rather than something that looks like malware. He disclosed the flaw publicly without first notifying Meta, saying he wanted users to understand the risk, and Meta has since pushed out what he called a fix.
Why it matters: as enterprises grant AI assistants broad permissions to act on their behalf, one misconfigured setting can turn a trusted, signed app into an attacker's foothold, a reminder that agent access, tokens and telemetry need the same scrutiny as any other privileged system.