pwardle/not-a-musedProof-of-concept exploiting an undocumented Muse dictation endpoint setting, letting a local unprivileged process redirect dictation traffic to capture prompts and abuse app access.
A proof-of-concept for a local Muse (https://muse.ai) vulnerability 0day that can let an unprivileged local process redirect Muse’s dictation traffic and abuse the trust/access granted to the app.
Muse exposes an undocumented setting:
endo_voyager_dictation_endpoint
A local attacker or malware can modify this endpoint without special privileges.
Once redirected, dictated prompts can be sent to an attacker-controlled endpoint, potentially allowing:
In short: Muse’s access can potentially become the attacker’s access.
Run:
./not-a-mused -h
for available options.
The PoC implements a subset of the 50+ commands exposed by Muse.
Once running, click the microphone button in Muse and dictate a prompt to trigger the PoC.
This is a local attack. An attacker must already be able to execute code as the local user.
The concern is that Muse may have significantly broader access than ordinary local malware, making it a particularly useful target for privilege/access amplification.
Provided for security research and educational purposes.