Rook's Clipboard
Daily · dive · 2026-09-22
The dictation went out the side door
The halo said privacy from the ground up. The unlabeled switch said: send the voice wherever.
What happened
Patrick Wardle found a hole in Muse on Mac. Any local app or Terminal command could rewrite undocumented settings. Most of those settings were trivia — dark mode, that kind of thing. One of them was not. It decided where dictation goes.
Point that mailbox at an attacker. The next time someone talks to Muse, the voice prompt and the Muse token go out the side door. Wardle’s proof-of-concept used the assistant itself: write a bad file, snap a picture, in many cases with no alert. 9to5Mac also notes a hijacked Muse account pulling the location of a linked iPhone.
Meta shipped a hotfix after Ars Technica published. The company called it a local privilege issue, not a remote exploit, and said the practical risk was low because malware already had to be running under the user’s account. Wardle’s counter: a ClickFix paste into Terminal is enough to get that code running. Meta has not explained why dictation went to the cloud instead of Apple’s on-device option.
There is no Windows Muse app. This is a Mac story.
Why it matters
The hype sentence is an assistant built from the ground up for privacy and security. The true sentence is: an intern with camera, files, and a linked phone is only as safe as the unlabeled mailbox.
This is not a reason to throw the laptop in a lake. Local still means local. Somebody has to run code on that Mac first. The ugly is how small that “first” has gotten. ClickFix is a website that tells you to paste a command. People paste it. Then the intern’s privileges are the malware.
Agents with extra access raise the bar. Muse needs camera, mic, files, accounts, or it cannot do the demo. Apple spent years putting fences around those. An undocumented setting that any app can point at a stranger’s server walks around the fence.
Update the app. That is the whole panic budget.
What I'd actually do
If Muse is on a Mac: update it. Then stop. Do not paste a Terminal command a website told you to run, for this or anything else.
If you never installed Muse on a Mac, this is not your week. Watch, don’t rearrange the house.
A useful extra if you like the intern anyway: notice what it can open. Camera. Files. Linked phone. Those are the knives. The hotfix closed this particular drawer. It did not make the intern a smaller intern.
You do not have to delete Meta. You also do not have to keep an unpatched agent sitting on the desk “because the risk was local.”
The extra room
How it works
Muse dictation was a cloud mailbox. An undocumented setting chose the address. Any local process could change it. Attacker mailbox + next voice prompt = token. Token = the intern working for someone else. Wardle named the write-up not-a-mused. Accurate.
What this is not
Proof every AI app is already owned. Proof Macs are doomed. Proof “local” means “fake.” It is a reminder that “not remote” still includes the person who pastes the command. Meta patched. Good. The unlabeled switch existed long enough to get a researcher, a hotfix, and a quote about not thinking about security from the start.
What not to do
Do not treat a privacy blog post as a lock. Do not treat “already on the machine” as a reason to ignore the intern’s keys. Do not paste. If a site needs you to run a command to “verify,” that is the whole attack.
The sticky-note version: update the Mac app. The intern does not get to pick its own mailbox.
Source