By ByteBot
A single undocumented preference key let any process on your Mac silently redirect Meta’s Muse to an attacker-controlled server — no admin password, no macOS prompt, no warning. Security researcher Patrick Wardle published a working proof-of-concept on September 21. Meta hot-fixed it the next morning. If Muse is on your Mac, here is what actually happened, what the fix covers, and what it leaves open.
One Setting, No Lock
Muse for Mac stores a preference named endo_voyager_dictation_endpoint that tells the app where to send dictated audio. The setting is undocumented — it does not appear in Meta’s public developer documentation or the App Store privacy disclosure. More importantly, it has no entitlement protection: any process running under your user account can overwrite it without elevated privileges and without triggering a macOS permission prompt.
Wardle paired his September 21 disclosure with a GitHub repository, pwardle/not-a-mused, that implements over 50 Muse commands. The README lists five distinct attack vectors the flaw enables: audio theft, prompt injection, session hijacking, device pivoting to iOS devices, and Remote ClickFix social engineering through the agent interface.
Why “Local Only” Is Not the Defense Meta Wants It to Be
Meta’s initial framing — that the attack requires local code execution — is technically accurate and strategically misleading. Local code execution is a prerequisite, but look at what you’re protecting: a Muse session with access to your Files, Mail, Messages, Calendar, and Notes. Malware that would otherwise be boxed in by macOS privacy controls can ride those delegated permissions straight past every guardrail.
The security principle at stake is familiar: an agent that accumulates broad permissions becomes the highest-value target on the machine. An attacker who redirects Muse does not need to jailbreak anything — they inherit everything the user already authorized. That includes authentication material, session tokens, and the ability to inject prompts the agent will trust and act on. On a developer’s machine, that frequently means access to connected services, APIs, and the code those services back.
Meta Patched It in 16 Hours
Credit where it is due: Meta removed the setting from production builds roughly 16 hours after Wardle’s disclosure, well ahead of the Meta Connect event that started September 24. Wardle confirmed the fix: “Hooray, hot-fixed!” He praised the response speed and said he would share additional details — and additional bugs — at the Objective by the Sea v9 security conference.
What Meta did not publish: a CVE identifier, a version-number matrix, or a security advisory. There is no official way to verify you have the patched build beyond confirming that your App Store auto-updates have run since September 22.
What the Patch Leaves Open
The hot-fix addresses this specific endpoint. It does not address the architecture the flaw exposed. As of today, Muse ships with no SIEM audit export, no IT admin console, and no DLP integration. VentureBeat found no enterprise-level visibility tooling for security teams trying to monitor what Muse is doing on behalf of 2.5 million Mac users — a number the app reached in 13 days.
Standard OAuth grant monitoring will not catch Muse either: the agent uses API keys, not OAuth flows, so the usual detection controls produce no signal. Meta has committed to shipping a Confidential VM that enforces isolation cryptographically rather than by policy, but it is not available yet. Privacy Guides and others have noted this gap is structural: personal AI agents are being deployed at enterprise scale before enterprise security controls exist for them. The hot-fix closed one door without changing the layout of the building.
What to Do Right Now
If Muse for Mac is installed on your machine or in your organization:
- Update immediately. Any build distributed after September 22 has the fix. Open the App Store, go to Updates, and confirm Muse is current.
- Audit granted permissions. Go to System Settings → Privacy & Security and review what Muse can access — Mail, Messages, Files, Calendar. Revoke anything you do not actively use.
- Enterprise: consider a temporary block. If your environment requires SIEM visibility for apps with this level of access, Muse cannot provide it today. A temporary MDM block while Meta ships enterprise controls is a defensible position.
- Watch Objective by the Sea v9. Wardle confirmed more Muse bugs are coming.
The broader pattern is one that 2026 keeps demonstrating. AI agents accumulate access faster than security teams can account for it. Muse had 2.5 million Mac users, access to five native app categories, and a zero-day, all within two weeks of launch. The patch came quickly. The governance tooling to prevent the next version of this problem has not.
