The technique hinges on a hidden setting that controls where dictated prompts are sent. When a user taps the microphone and speaks a prompt, the modified configuration redirects that audio to the attacker rather than to Meta. Because the abuse relies on access the app already has, the malicious behavior can blend into normal assistant activity.

Wardle's work shows the attack requires pre-existing malware on the system, meaning it is a post-compromise escalation path rather than a remote exploit on its own. The concern is the trust users place in the assistant's granted permissions: a small configuration change is enough to convert that trust into a channel for exfiltration or command delivery.

Key points from the research:

• Target platform: macOS
• Affected product: Meta Muse assistant
• Attack vector: a hidden setting that alters destination of dictated prompts
• Prerequisite: malware already running on the Mac
• Demonstrated by: Patrick Wardle, proof-of-concept published September 21

Source: The Hacker News

Does your organization grant AI assistants microphone or dictation permissions, and are you reviewing those settings on managed Macs?