Meta's Muse flaw lets Mac malware reach linked iPhones, researcher says

Why it matters

Personal agents concentrate permissions across computers, phones and cloud accounts. Wardle's exploit shows how one local Mac breach can inherit that reach and cross device boundaries.

Patrick Wardle (@patrickwardle), the founder of the Objective-See Foundation, disclosed a vulnerability in Meta's Muse Mac client on September 21st that he says can let malware on a user's Mac reach other devices connected to the same Muse account, including an iPhone.

Wardle, a former NASA and NSA employee who has spent years analyzing macOS malware, posted a three-part demonstration showing a compromised Muse session remotely obtaining an iPhone's location in Barcelona and initiating a Bluetooth Low Energy scan on the phone. He said the mobile tasks ran invisibly through the Muse client.

The disclosure extends the impact of a local Mac vulnerability beyond the computer where malicious code initially runs. Muse is designed to operate across mobile, web and desktop clients tied to the same personal agent. Wardle's work shows how that cross-device design can give an attacker a route from one compromised endpoint to another.

The attack starts with an unprotected setting

Wardle published a proof of concept called not-a-mused for what he describes as a local zero-day in the Muse macOS app. The attack requires an adversary or malicious program to already be able to execute code under the Mac user's account. It is not a drive-by remote compromise of an otherwise untouched Mac.

The Muse client exposes an undocumented setting named endo_voyager_dictation_endpoint, according to Wardle's repository. An unprivileged local process can change that setting and redirect dictated prompts to an attacker-controlled server. Wardle says that interception can expose dictated audio and prompts, inject instructions into Muse and capture Muse authentication material.

The proof of concept then queries Muse's device inventory through an account API. Each connected device advertises the commands it supports, along with a device identifier and whether it is online. Wardle's code can select an online device and direct Muse to invoke an available command on it.

Wardle says Muse exposes more than 50 commands, while his public code implements only a subset. The repository includes paths for describing a device's environment, querying its advertised commands and requesting actions from a selected device. His X demonstration focused on iPhone location and Bluetooth scanning.

That distinction matters because the initial foothold has limited privileges. Apple normally uses its Transparency, Consent and Control system to prevent an ordinary process from reading location, accessing the microphone or reaching other protected data without approval. Muse may already possess permissions that the user granted for legitimate agent tasks. Wardle characterizes the vulnerability as access amplification: malware targets Muse so it can inherit the agent's broader reach.

Muse's security boundary stops at the client

Meta launched Muse on September 8th as a personal agent that can browse websites, fill out forms, send email and make purchases on a user's behalf. Meta said people would control which services Muse could access and promised approval checks before sensitive actions.

Meta's main security architecture centers on Muse Secure VM, a dedicated cloud computer that stores the agent's data and connected credentials. A separate Sentinel service is supposed to authorize connector actions and network traffic. Meta's technical security description says the agent does not receive raw passwords or authentication tokens and that mobile clients connect directly to the user's VM through a secure transport layer.

Wardle's finding targets a different boundary: the software installed on the user's computer and the trust connecting that client to the wider Muse account. Cloud isolation offers limited protection when a local client can be redirected before its traffic reaches the protected environment.

The timing leaves Meta's desktop security claims facing an immediate test. Meta announced the Mac client on September 17th, advertising access to files, Messages, Calendar, Notes and Mail. Wardle published his proof of concept four days later. The underlying Muse service had been public for 13 days.

Meta opened a Muse bug bounty at launch and said it would pay up to $300,000 for qualifying reports. Its security post focused heavily on prompt injection, credential isolation and attacks against the cloud agent. Wardle's demonstration shows that personal agents also inherit a familiar endpoint-security problem: malware does not need to defeat every layer when it can take over a trusted client already carrying the user's identity and permissions.

For Muse users, the prerequisite narrows the immediate threat without making the flaw trivial. An attacker must first run code on the Mac. Once that happens, Wardle's research indicates that the blast radius can include the user's agent account and other connected devices, rather than ending at the compromised computer.