Meta patched a Muse macOS zero-day after a researcher disclosed a proof of concept.
Why it matters: Muse can reach files, email, messages, calendar and other services when users grant access. That makes flaws in AI agents a privacy and control risk, not just a software bug.
- Patrick Wardle disclosed proof of concept code, 'not-a-mused,' on Sept. 21, 2026.
- The flaw involved an undocumented Muse setting, endo_voyager_dictation_endpoint, that a local process could change.
- Wardle said an attacker could capture dictated prompts, inject instructions, steal session material and abuse existing permissions.
- The exploit required code already running on the victim's Mac and was not a direct remote compromise.
Meta patched a flaw in the macOS version of Muse after security researcher Patrick Wardle published a proof of concept showing how the assistant could be manipulated, according to The Verge. Wardle described the issue in a GitHub post titled not-a-mused.
His write-up focused on an undocumented setting called endo_voyager_dictation_endpoint. Wardle said a local, unprivileged process could change that setting and redirect dictation traffic away from Meta and to an attacker-controlled endpoint.
Wardle said that could let an attacker capture dictated prompts, inject prompt instructions, steal Muse session and authentication material, and abuse the access a user had already granted the assistant. He wrote that, in his view, this meant an attacker could manipulate the agent and leverage its privileges in ways the product was not meant to allow.
The issue was not a remote takeover of the Mac. It required code already running on the victim's machine, according to The Hacker News.
Muse launched in the U.S. on Sept. 8, 2026 as a personal AI agent with access to files, email, messages, calendar, shopping and other connected services depending on user authorization, Meta said in its launch materials and research post. Meta also said it had hardened the product through dogfooding, red teaming and a private bug bounty program.
Independent coverage from Ars Technica, The Register and Malwarebytes also described the flaw as a reminder that highly privileged AI assistants can become dangerous if local malware or other code can abuse their permissions.
By the numbers
- Sept. 21, 2026 - Wardle's proof of concept post date.
- 1 local process - the exploit needed code already running on the victim's Mac.
- Sept. 8, 2026 - Muse's U.S. launch date.
Yes, but: The exploit did not show a direct remote compromise of the Mac; it depended on existing code execution on the victim's machine.