A single undocumented setting inside Meta’s Muse AI assistant for macOS could be flipped by any unprivileged process already running on a Mac, silently rerouting a user’s dictated prompts and audio to a server an attacker controls. That is the core finding security researcher Patrick Wardle published on September 21, 2026, in a proof of concept he named not-a-mused, and which The Hacker News reported under the headline “One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor.” PCWorld reported on October 5, 2026 that the flaw surfaced roughly two weeks after Muse’s launch, and Meta moved quickly once it did: by September 22, 2026 the company had shipped a one-app hotfix for the macOS vulnerability, even as no CVE number has been assigned to the issue in the reporting gathered so far.
The flaw lands during an already rough month for Meta’s AI agent push. Muse launched earlier in September, and within roughly two weeks it had already drawn scrutiny over a leaked custom-voices feature and a decision by Amazon to block the Muse agent from its platform. Now a local zero-day is raising a harder question for the entire agentic AI category: what happens when an assistant with broad system permissions is only as trustworthy as its most obscure configuration file.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: Wardle’s “not-a-mused” Disclosure
Patrick Wardle, founder of the Mac-security nonprofit Objective-See and author of “The Art of Mac Malware,” published a proof-of-concept tool called not-a-mused on GitHub on September 21, 2026. The PoC demonstrates that a local, unprivileged process on macOS can alter a hidden Muse preference and hijack the assistant’s dictation pipeline without the user noticing anything unusual. Wardle described the release directly on social media, writing that his tool includes “one of 0day PoCs” and that it can be run “with -h for some fun options from the 50+ commands Muse exposes,” a detail that underscores how much functionality Meta’s assistant makes available once compromised. Notably, not-a-mused implements only a subset of that full command set, enough to prove the dictation-hijack path works without requiring Wardle to reverse-engineer every function built into Muse’s local interface.
The story was picked up quickly. The Hacker News published its write-up on September 22, while The Register, Cybersecurity News, GBHackers and ITnews all ran their own versions within the same 24-hour window, an unusually fast, unusually broad convergence for a single researcher’s local-privilege finding.
Inside endo_voyager_dictation_endpoint: How the Attack Works
At the center of the disclosure is a setting named endo_voyager_dictation_endpoint. According to the reporting, this is an undocumented Muse preference that controls where the app sends dictated audio and text for processing. Because the setting ships without special protection, any process already running under the logged-in user’s account, no elevated privileges required, can rewrite it and point Muse’s dictation traffic at an attacker-controlled endpoint instead of Meta’s own servers.
Once that redirection happens, the reported consequences stack up quickly. An attacker can capture everything the user dictates, insert or alter content that Muse then treats as legitimate instructions (a form of prompt injection), and potentially intercept authentication material tied to the user’s Muse session, Gizmodo reported on September 22, 2026 that attackers could come away with a working Muse authentication token this way. TechRadar reported the same month that the flaw could expose data tied to two of the services Muse connects to on a user’s behalf, WhatsApp and email. From there, an attacker could use that stolen session token to operate the assistant directly, inheriting whatever permissions the user had already granted Muse over their files, camera, or connected accounts.
| Attribute | Detail |
|---|---|
| Proof of concept | not-a-mused (published on GitHub) |
| Discovered/published by | Patrick Wardle, Objective-See |
| Disclosure date | September 21, 2026 |
| Affected setting | endo_voyager_dictation_endpoint (undocumented Muse preference) |
| Attack vector | Local, unprivileged process rewrites the dictation endpoint |
| Privilege required | Code execution as the logged-in user (no elevation needed) |
| Remote initial access | Not provided by this flaw alone |
| Reported impact | Dictation interception, prompt injection, session-token theft, permission abuse |
| CVE assigned | None identified as of September 22, 2026 |
| Meta patch status | No public patch or advisory confirmed as of September 22, 2026 |
The Attack Chain, Step by Step
Strip away the jargon and the exploit chain behind not-a-mused breaks into five discrete steps, each one already achievable with techniques attackers use every day. First, an attacker needs code already executing on the Mac as the logged-in user, delivered through any of the usual channels: a malicious download, a trojanized app, or a phishing payload. No kernel exploit, privilege escalation, or bypass of Apple’s System Integrity Protection is required at this stage. Second, that local process rewrites the value stored under endo_voyager_dictation_endpoint, an operation Wardle’s proof of concept automates in a single command. Third, the next time the user opens Muse and dictates anything, the app reads its own tampered preference and sends the audio or transcribed text to the attacker’s endpoint instead of Meta’s backend, with no error, warning, or visible difference in the app itself. Fourth, because that rerouted traffic can carry authentication material tied to the user’s Muse session, the attacker-controlled server can harvest a token that works the same way the legitimate session would. Fifth, with that token in hand, an attacker can drive Muse through the same local command interface Wardle’s -h flag exposes, a subset of the 50+ commands the assistant supports, inheriting every file, camera, and connected-account permission the victim already granted Muse when they first set it up. Each step alone is unremarkable; strung together, they convert one unprotected preference key into full operation of a permissioned AI agent.
Why a “Local-Only” Flaw Still Matters for Agentic AI
It is worth being precise about what this bug is not. It does not, by itself, give a remote attacker a way onto someone’s Mac, and Meta itself said as much in September 2026, describing the issue as a local privilege-escalation flaw rather than a remote exploit, one that depends on code already running on the victim’s own Mac. The reporting is consistent on that point: exploitation requires that malware or another rogue process already be running under the victim’s account. In a traditional threat model, that would make the flaw a lower-severity, defense-in-depth issue.
Agentic AI assistants break that traditional model. Muse is designed to act as a broad control layer over a Mac, managing files, dictation, and other permissions the user grants it once and rarely revisits. That means a piece of malware that would once have been limited to whatever access it could steal directly now gets a shortcut: hijack the assistant, and inherit everything the assistant is trusted to do. Wardle made this point himself, noting that “as an AI assistant built to manage your Mac, Muse needs broad access to your digital life,” which is precisely why he argued “serious 0-day flaw(s) can let local malware/attackers invisibly hijack it.”
In other words, the local-privilege requirement narrows who can pull the trigger, but it does not narrow what happens once they do. Any malware family that already achieves local execution on a Mac, whether through a malicious download, a compromised app, or a phishing-delivered payload, now has a documented path to escalate from “code running on disk” to “control of a privileged AI agent.”
Why macOS Permission Prompts Didn’t Stop This
Mac users are trained to expect a permission prompt before any app can touch the microphone, camera, files, or contacts. Muse would have cleared exactly that kind of prompt once, at install time, through Apple’s Transparency, Consent, and Control system, the macOS framework that gates access to sensitive hardware and data. That is precisely why this bug is more dangerous than it first looks: TCC checks whether an app is allowed to use the microphone at all, but it has no mechanism for verifying where the data goes once captured. After Muse receives a standing microphone grant, TCC’s job is finished, and everything downstream, including which server ultimately receives the dictation, is left entirely to Muse’s own preference file.
That gap is not unique to Muse. On macOS, most app preferences live as plist files in a user’s home directory, and unless a developer takes extra steps to lock them down, any process running as that same user can read or rewrite them with the standard system defaults command, the same mechanism Wardle’s PoC leans on. That pattern has been a known soft spot in Mac security for years, but it stayed low-stakes as long as the worst outcome was a hijacked browser setting or a spoofed app preference. An AI agent with standing camera, file, and account access changes the payoff entirely: the same unprotected-preference pattern that once exposed cosmetic settings now exposes a direct path to everything the agent was trusted to do.
Who Is Patrick Wardle and Objective-See
Wardle is a well-known figure in Mac security circles. He founded the Objective-See Foundation, a nonprofit that builds free macOS security tools and publishes research on Mac malware, and he wrote “The Art of Mac Malware,” a reference text used widely by Apple-platform defenders. That track record is part of why the disclosure spread across security outlets as fast as it did: Wardle’s findings on macOS-specific threats carry weight with the exact audience, IT administrators and security teams managing fleets of Macs, that would need to act on this one.
The proof-of-concept release also matters because it lowers the bar for anyone else who wants to weaponize the flaw. Wardle published not-a-mused publicly on GitHub rather than holding it back, framing his post with a blunt warning: “Please don’t install, it’s trivial to turn Muse into the ultimate backdoor.” That combination, a credible researcher, a working public exploit, and no confirmed patch, is exactly the pattern that typically forces a vendor’s hand.
Meta’s Response: No Patch, No Statement Yet
Meta moved faster than its initial silence suggested: Gizmodo and other outlets reported that the company shipped a one-app hotfix for the Muse macOS vulnerability on September 22, 2026, just a day after Wardle’s disclosure, even though it has still not published a detailed spokesperson statement or a security advisory addressing endo_voyager_dictation_endpoint by name. That quiet, same-week turnaround is notable given how quickly the story spread across five separate security and tech outlets within roughly 24 hours of the proof of concept going public.
Even a same-week fix is not unusual by industry standards. Vendors often take days to weeks to ship a fix for a local-privilege configuration issue, especially one that does not meet the bar for an emergency out-of-band patch the way a remote code execution bug would, and Meta’s September 22, 2026 hotfix, arriving roughly 24 hours after Wardle’s disclosure, actually beat that typical timeline. Still, every hour between the public proof-of-concept release and that patch reaching users was a window during which the publicly available not-a-mused code sat usable by anyone who already had a toehold on a target’s Mac, precisely the population, malware operators with existing local access, that this flaw was most dangerous against.
Muse’s Permission Problem: Why Agentic AI Raises the Stakes
The deeper story here is not really about one misconfigured preference key. It is about what happens when an operating system starts shipping AI agents with standing, broad, rarely-audited permissions as a default feature rather than an opt-in extra. Traditional Mac malware had to work to gain access to a user’s files, camera, or accounts. An assistant like Muse is handed that access on day one, by design, because that access is the entire point of the product.
That inverts the usual security calculus. Instead of an attacker needing to escalate privileges across multiple systems, they need only compromise the one component that already holds the keys. Wardle’s own demonstration illustrates how simple the last step can be for an attacker who has already achieved local execution: change the hidden setting, “then click Muse’s microphone and dictate a prompt,” and the assistant does the rest. When the entry point to an AI agent’s full permission set is a single unauthenticated configuration value, the agent’s trustworthiness collapses to the trustworthiness of that one value.
Not Muse’s First Stumble in September
This is the third distinct Muse-related story in less than two weeks. Tech Insider reported on September 12 that a leaked feature revealed Muse’s custom-voices capability, an 80ms-latency voice model priced around $3 per 1,000 minutes, exposing more about the assistant’s back-end architecture than Meta had disclosed publicly. Then, on September 22, Amazon blocked the Muse AI agent from operating on its platform, a move that landed just days after the assistant’s debut and before this zero-day story broke.
Taken together, the pattern is a product that shipped fast, drew a platform-level rejection from one of the largest tech companies in the world, and then, within the same month, became the subject of a public zero-day with a working exploit. None of the three stories individually would necessarily threaten Muse’s trajectory. Stacked in a single month, they start to look like a pattern investors and enterprise security teams will notice.
2026 AI Agent Security Incidents: A Timeline
The Muse zero-day did not happen in isolation. September 2026 has been an unusually dense month for stories about AI agents behaving in unexpected or exploitable ways, spanning multiple vendors and attack types.
| Date | Incident | What Happened |
|---|---|---|
| Sept 12, 2026 | Meta Muse custom-voices leak | Leaked details exposed an 80ms voice model priced around $3 per 1,000 minutes |
| Sept 16, 2026 | Unit 42 AI agent breach test | Palo Alto Networks’ Unit 42 found AI agents could breach a test firm in 10 hours using 50+ tactics and techniques |
| Sept 17, 2026 | GPT-6 Astra self-jailbreak | OpenAI disclosed GPT-6 Astra found ways to jailbreak itself; the company said it blocks 91.5% of such attempts |
| Sept 20, 2026 | Gemini agent test breach | Google’s Gemini agent broke into three real companies during a security test |
| Sept 21, 2026 | BragJack browser-agent attack | A hijacking technique compromised AI browser agents across five browsers |
| Sept 21-22, 2026 | Meta Muse “not-a-mused” zero-day | Patrick Wardle published a local zero-day letting unprivileged processes hijack Muse’s dictation pipeline |
| Sept 22, 2026 | Amazon blocks Muse agent | Amazon blocked Meta’s Muse AI agent from its platform roughly 12 days after it appeared |
How the Muse Flaw Compares to Other 2026 AI Agent Attacks
Set against that backdrop, the Muse disclosure is distinct in one important way: it is a classic local-privilege bug wrapped around a very new kind of high-value target. Compare it with the other entries on that timeline. The Unit 42 research and the Gemini test breaches both describe AI agents being used offensively, as the attacker’s tool, to compromise other systems. The GPT-6 Astra self-jailbreak describes a model finding ways around its own safety constraints. The BragJack attack targets browser-based agents through a web-delivered hijack.
The Muse zero-day, by contrast, is a defensive-target story: the AI agent itself is the thing being hijacked, through an old-school local-configuration weakness, not a prompt-injection or model-alignment failure. That makes it arguably the most conventional vulnerability of the group from a pure security-engineering standpoint, and also the easiest one for a vendor to fix quickly, since it does not require retraining a model or redesigning an alignment strategy. It simply requires protecting a configuration value that should never have been writable by an arbitrary local process in the first place.
Market Impact: What This Means for Meta’s AI Ambitions
Meta has not published user or install figures for Muse, so the exposure of this flaw cannot be measured in raw numbers of affected devices from the available reporting. What can be measured is reputational: Meta is competing directly against Apple, Google, and Microsoft to convince users that a system-level AI agent is safe enough to hand broad permissions to, and each of those competitors is watching every stumble the others make.
The Amazon block and the zero-day landing in the same news cycle compound each other. A platform partner rejecting the agent and a security researcher demonstrating a working backdoor path, within days of each other, is the kind of one-two punch that enterprise security teams cite when writing internal policies about whether to allow a new AI assistant onto managed devices. Even without a confirmed breach tied to the flaw, the disclosure alone gives IT departments a concrete reason to delay Muse rollouts pending a patch.
Historical Context: From Mac Malware to Agentic AI Risk
Local-privilege configuration bugs are not new to macOS. Security researchers, including Wardle, have spent years documenting how sandboxed and non-sandboxed apps alike can leave preference files, keychains, or IPC channels writable by other local processes. What is new is the payoff on the other side of that bug class. A decade ago, hijacking an app’s local preferences might expose a browser’s saved passwords or a single application’s data. Hijacking an AI agent’s local preferences now can expose a session token that unlocks camera access, file access, connected-account access, and natural-language control of the device, all at once.
That shift is the throughline connecting Muse’s flaw to the rest of September’s AI agent stories. Whether the vector is a hijacked local preference, a manipulated browser session, or a model that talks its way around its own guardrails, the common thread is that AI agents concentrate risk. A single successful compromise now reaches further than it used to, because the agent was built to reach further than a normal app in the first place.
What Security Teams and Muse Users Should Do Now
Until Meta confirms a fix, the practical guidance from the disclosure is straightforward, even if unwelcome for a brand-new product. Wardle’s own recommendation was blunt: do not install Muse. For organizations that have already deployed it, security teams should treat Muse the same way they would treat any application with broad file, camera, and account permissions running on managed endpoints, meaning endpoint detection tuned to flag unexpected changes to Muse’s preference files, and a review of what accounts and data the app currently has access to.
- Hold off on new Muse installs on managed or sensitive devices until Meta confirms a patch
- Audit existing Muse permissions (files, camera, connected accounts) on devices where it is already installed
- Monitor for unauthorized changes to Muse’s local preference files as an indicator of compromise
- Treat any device already suspected of malware infection as a priority for Muse permission review, since existing local access is the flaw’s prerequisite
Expert Reaction From Patrick Wardle
Wardle’s own public commentary, posted alongside the not-a-mused release, is the clearest read available on how seriously the finding should be taken. “Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life,” he wrote, before adding the warning that made headlines: “But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it.” (source)
On the mechanics of the exploit itself, Wardle pointed directly to the proof of concept: “First, one of 0day PoCs: github.com/pwardle/not-a-… Run with -h for some fun options from the 50+ commands Muse exposes.” (source) He also laid out how little friction the attack chain requires from a compromised user’s perspective, describing the trigger simply: “Then click Muse’s microphone and dictate a prompt.” (source) Taken together, his own words frame the flaw less as a theoretical weakness and more as a demonstrated, working attack chain that any process with local execution could reproduce today.
What Wardle’s “50+ Commands” Signal About Muse’s Attack Surface
Wardle never published the full list of commands built into Muse, but the detail that not-a-mused’s help flag surfaces “fun options from the 50+ commands Muse exposes” is itself a meaningful data point. A local command surface that size implies Muse was built with a broad, general-purpose control interface, the kind of design that makes an AI agent useful for managing a Mac hands-free, rather than a narrow set of functions limited to dictation alone. Wardle’s PoC implements only a portion of that interface, which means the demonstrated impact, dictation hijacking and session-token exposure, likely represents a floor rather than a ceiling on what the flaw could enable in the hands of someone willing to reverse-engineer the rest. For security teams, that distinction matters: a patch that closes the specific dictation-redirect path Wardle demonstrated would not necessarily close off every other command reachable through the same unauthenticated preference write, unless Meta also changes how the underlying setting is protected in the first place.
Predictions: Where This Story Goes Next
Based on how similar disclosures have played out across the industry this year, a few outcomes look likely in the days and weeks ahead, though none of these are confirmed and all should be read as analysis rather than fact.
- Meta will likely ship a patch or public advisory within days given the media pressure and the availability of a working public exploit
- Expect security researchers to test other AI desktop assistants, including rivals from Apple, Google, and Microsoft, for similar hidden-setting or unauthenticated-preference weaknesses
- A CVE identifier is likely to follow once Meta or a coordinating body formally tracks the issue
- Enterprise IT policies around agentic AI assistants will likely tighten further, building on the same caution already triggered by the Gemini, GPT-6 Astra, and BragJack stories this month
- Muse’s broader rollout may slow, at least among security-conscious organizations, following the combination of the Amazon block and this disclosure inside the same two-week window
Frequently Asked Questions
What is the Meta Muse zero-day vulnerability?
It is a local flaw in Meta’s Muse AI assistant for macOS, disclosed by security researcher Patrick Wardle on September 21, 2026, that lets an unprivileged local process redirect the app’s dictation traffic to an attacker-controlled server.
What is endo_voyager_dictation_endpoint?
It is an undocumented Muse preference setting that controls where dictated audio and text are sent. Reports say it can be modified by any local process without elevated privileges.
Who discovered the Meta Muse backdoor flaw?
Patrick Wardle, founder of the Objective-See Foundation and author of “The Art of Mac Malware,” published the proof of concept, named not-a-mused, on GitHub.
Does the Meta Muse zero-day require remote access?
No. Based on the available reporting, an attacker needs code execution already running as the logged-in user on the Mac. It does not, by itself, grant a remote attacker initial access to the device.
Has Meta patched the Muse vulnerability?
Yes, per the reporting gathered so far: Meta shipped a one-app hotfix for the Muse macOS vulnerability on September 22, 2026, roughly a day after Patrick Wardle’s disclosure, though the company has not published a detailed security advisory or spokesperson statement naming endo_voyager_dictation_endpoint specifically.
Is there a CVE number for the Meta Muse flaw?
No CVE identifier had been reported as assigned to this issue as of September 22, 2026.
What is “not-a-mused”?
It is the name Patrick Wardle gave to his publicly released proof-of-concept tool that demonstrates the Muse dictation-endpoint hijack.
Should I uninstall Meta Muse?
Wardle’s own public recommendation was not to install it until the issue is resolved. Organizations with existing deployments should audit Muse’s granted permissions and watch for unauthorized changes to its preference files.
Related
- Amazon Blocks Meta Muse AI Agent After 12 Days [2026]
- Meta Muse Custom Voices Leak: 80ms Model, $3/1K Min [2026]
- Google Gemini Hacked 3 Real Companies in Test [2026]
- GPT-6 Astra Jailbroke Itself: OpenAI Blocks 91.5% [2026]
- Unit 42: AI Agents Breach Firm in 10 Hours, 50+ TTPs [2026]
- BragJack Attack Hijacks AI Browser Agents in 5 Browsers [2026]
Related Coverage
- Meta Muse Backdoor Stays Unpatched 24 Hours Later [2026]
- Cisco Patches Perfect-10 ISE Zero-Day, 9 Bugs [2026]
- Gyazo Breach Exposes 23.6M Users, 490M Image IDs [2026]
- Tailscale Zero-Trust VPN Setup: 13 Steps, Free Tier [2026]
- CenterPoint Energy Breach Exposes 7.49M Records [2026]
