The Intruder Didn’t Need the Keys. He Had the Butler
Imagine a mansion full of locked rooms.
Files in the study. Email and messages behind another door. The calendar in the office. Shopping accounts and smart-home controls elsewhere.
The owner has protected everything carefully.
But there is one person allowed to move between those rooms:
the butler.
Meta’s Muse works in much the same way. Users can grant the AI assistant access to files, email, messages, calendar, shopping and smart-home apps.
Every permission puts another key on the butler’s ring.
Researcher Patrick Wardle demonstrated what could happen if an attacker already inside the Mac found a way to control who that butler listens to.
Phase 1 — Get Inside the Mansion
The attack cannot compromise a Mac on its own. Attacker-controlled code must already be running as the logged-in user.
Wardle suggested a ClickFix-style attack could provide that initial foothold by tricking someone into executing a command.
The intruder is now inside.
But the doors around him are still locked.
Then he notices the butler carrying the keys.
Phase 2 — Find the Butler’s Hidden Earpiece
Wardle discovered an undocumented Muse preference:
endo_voyager_dictation_endpoint
It determines where Muse sends voice dictation.
Software running as the logged-in user could change it without additional permissions, redirecting dictation toward attacker-controlled code.
The burglar doesn’t steal the butler’s keys.
He changes who is speaking through his earpiece.
Phase 3 — Listen to the Owner
Now the intruder waits.
When the owner activates Muse’s microphone and dictates a prompt, the redirected communication allows the attacker to read what was said.
The owner believes he is privately speaking to his assistant.
Someone else is listening from behind the wall.
Phase 4 — Whisper New Orders
Listening is only the beginning.
Wardle demonstrated that an attacker could add extra instructions that Muse would trust and act upon.
The owner gives the butler an order.
Before it reaches him, the intruder whispers another.
And because the instruction reaches a legitimate assistant with legitimate permissions, the butler can potentially approach doors the burglar himself cannot open.
Phase 5 — Steal the Butler’s Badge
Muse also sends its authentication token through the redirected communication.
Wardle demonstrated that an attacker could capture it and use it to access Muse chat history and control the assistant directly.
Because a Muse account can operate across devices, the implications can extend beyond the compromised Mac.
In his own tests, Wardle instructed Muse on an iPhone to report its exact location, scan nearby Bluetooth devices and list available smart-home commands.
The intruder entered through one room.
The butler could potentially take him into other wings of the mansion.
Phase 6 — Walk Past the Guards
This creates another problem.
The actions can come through Muse itself: a legitimate, signed application that the owner deliberately installed and authorized.
The security guard sees the familiar uniform.
The correct credentials.
The legitimate key.
And opens the door.
The attacker can remain hidden while the trusted butler performs the visible actions.
Phase 7 — Take Back Unnecessary Keys
The research did not demonstrate a compromise of Meta’s cloud isolation or a general bypass of macOS credential protections. The attacker still requires an initial foothold on the Mac.
Wardle subsequently said Meta had pushed a fix, although the article reported that its exact scope had not yet been confirmed.
Until then, users can reduce exposure by quitting or removing Muse if concerned, revoking unnecessary permissions and integrations, avoiding voice input, and never executing Terminal commands simply because a website or message instructs them to.
If compromise is suspected, Muse and connected accounts should also be treated as potentially exposed.
The Butler Is Valuable Because He Is Trusted
AI assistants become more useful as we give them more access.
Files.
Messages.
Calendar.
Applications.
Devices.
More keys on the same ring.
That makes controlling the assistant potentially more valuable than attacking every service individually.
The burglar enters the mansion and sees a corridor full of locked doors.
Then the butler walks past.
The keys jingle from his belt.
The burglar doesn’t reach for them.
He leans toward the butler’s earpiece and whispers:
“From now on, listen to me.”
And the butler walks toward the first door.
The Hacker News
Comentarios