Meta Muse Zero-Day Lets Local Apps Hijack the AI Agent
Security researcher Patrick Wardle disclosed a Meta Muse zero-day on September 21. An unprivileged process already running on a Mac can redirect Muse's dictation traffic, potentially capture authentication material, and abuse the agent's existing access. This is a local attack, not a remote compromise of an untouched Mac. Meta has not confirmed a patch.
On this page
The Muse Mac client trusts a changeable dictation endpoint
Security researcher Patrick Wardle disclosed a zero-day in Meta's Muse client for macOS on September 21. His not-a-mused proof of concept shows that an unprivileged local process can change an undocumented setting named endo_voyager_dictation_endpoint. That setting controls where Muse sends dictated prompts.
Redirecting the endpoint to an attacker-controlled server can expose dictated audio or prompts, allow instructions to be altered before they reach Muse, and reveal authentication material used by the assistant. Wardle says the same route can let an attacker issue commands through the victim's Muse account and use access the person has already granted to the agent.
The important limit is in Wardle's own disclosure: the attacker must already be able to run code as the local Mac user. This is not evidence that anyone on the internet can take over an untouched Mac or Muse account. No exploitation in the wild has been reported.
A local foothold can reach beyond the original app
macOS normally asks users to approve access to sensitive resources such as the microphone, camera, files, location, and calendars. Malware without those permissions should not automatically inherit them from another application. An assistant changes the risk because it may already be trusted to work across several resources and connected services.
Ars Technica reported that Wardle used the flaw to write files and take pictures through Muse, sometimes without an obvious alert. The report also says the redirected traffic includes the token that authenticates the Muse account, which could make control persist beyond the first dictated prompt. Meta did not answer Ars's questions before publication.
This is why describing the prerequisite as "local code execution" does not dispose of the problem. ClickFix campaigns already persuade people to paste and run terminal commands. A small local foothold can become more valuable when it can operate an assistant connected to email, WhatsApp, calendars, a camera, or other services. The Register separately confirmed with Wardle that he views the flaw as access amplification rather than a remote entry point.
Muse's cloud safeguards do not cover the client flaw
Meta's security design places each Muse agent in a dedicated cloud virtual machine. A separate Sentinel component governs network access and connector actions, while credential services are intended to keep real third-party tokens away from the model's runtime. Meta says the system was tested through internal red teaming and a public bug bounty.
Wardle's disclosure concerns the Mac client before those cloud boundaries can help. The client lets a local process change the destination for dictation traffic. If authentication material is then sent to the replacement destination, isolation inside the cloud VM does not prevent the client from handing an attacker the means to act as the account.
The choice to send dictation to a configurable cloud endpoint also creates exposure that local transcription would avoid. This does not prove that every cloud voice feature is unsafe. It shows that endpoint configuration, token handling, and local permission boundaries have to be treated as part of an agent's security model, not as a thin transport layer outside it.
There is no confirmed patch or Meta advisory
As of September 22, Meta has not published a security advisory, CVE, affected-version range, or confirmed fix for this issue. Wardle's repository describes the proof of concept as a zero-day, and both Ars and The Register reported that Meta did not respond before their articles were published.
Muse users should not infer that deleting connected services or changing passwords is required from the public evidence alone. The immediate, evidence-based precautions are narrower: do not run copied terminal commands, review which accounts and device permissions Muse can access, disconnect anything the agent does not need, and wait for a specific Meta advisory or patched client version before treating the flaw as resolved.
The wider lesson applies to any agent with broad permissions. Security review has to include the desktop or mobile client, local configuration, authentication hand-off, and every path that can turn an ordinary process into a command channel. A hardened cloud sandbox cannot compensate for a client that exposes control before the request reaches it.