Meta Patches Muse Mac Dictation Hijack: What the Local Attack Could Access

By AiCybr Editorial · Published September 23, 2026

Meta issued a hotfix on September 22, 2026 for a vulnerability in the Muse macOS app that allowed code already running as the logged-in user to redirect Muse's cloud dictation traffic to an attacker-controlled endpoint. Security researcher Patrick Wardle published the proof of concept on September 21 and documented an undocumented preference named endo_voyager_dictation_endpoint that an unprivileged local process could modify.

The attack required local code execution under the user's account. Once the dictation endpoint was redirected, Wardle's research showed that the attacker could capture dictated prompts, inject prompts, obtain Muse authentication material and invoke capabilities available to the user's Muse session. Meta Superintelligence Labs' David Singleton said the company hot-fixed the app after disclosure and described the prerequisite as malicious code already running locally under the user's account.

For Muse users, the immediate action is to install the current Mac app update and avoid running an older build. Meta and the researcher have not published a CVE identifier or a version-number matrix for the hotfix, so the remediation target is the current production build distributed after the September 22 fix.

What Wardle found

Muse's Mac client supports voice dictation. Wardle found that the application stored an undocumented setting controlling the server endpoint used for dictation processing. His public not-a-mused repository identifies the preference as endo_voyager_dictation_endpoint and states that another process running as the same user could change it without elevated privileges.

That matters because Muse can hold access that ordinary local applications may lack. Depending on what a user has connected or granted, an agent can interact with services and data on the user's behalf. Wardle's proof of concept demonstrates the security consequence of redirecting the trusted dictation path: attacker-controlled input can reach an agent operating with those existing grants.

The researcher's repository lists four demonstrated or potential consequences of the redirected endpoint:

Wardle also states that his proof of concept implements a subset of more than 50 commands exposed by Muse. The public research is sufficient to establish the access-amplification risk without requiring users or defenders to reproduce the exploit.

The attack boundary

This issue has a specific prerequisite: malicious code must already be executing locally as the affected Mac user. Wardle states this explicitly in the proof-of-concept documentation, and Meta's public response makes the same distinction.

The security impact comes from capability amplification. Local malware may start with the permissions and data available to its own process. A compromised agent interaction can add whatever services, credentials or actions the user has already entrusted to Muse. The practical exposure therefore varies with each user's connected accounts and granted permissions.

The issue is separate from Muse Secure VM. Meta describes Muse Secure VM as the isolated environment in which the personal agent works on a user's behalf. Wardle's finding concerns the local macOS client and its dictation configuration path before trusted agent interaction proceeds through the service.

Meta's hotfix

The Verge reported on September 22 that Meta had patched the vulnerability within hours of public disclosure. Singleton wrote that exploiting it required malicious code already running under the user's account and said Meta had issued a hotfix to address the issue.

No exact patched build number is present in Wardle's repository, Meta's original Muse launch documentation or the public statement cited by current independent coverage. Users should update Muse from its normal distribution channel and confirm they are running the newest production build offered after September 22.

Organizations managing Macs should treat an outdated Muse installation as an application-remediation item and can use software inventory controls to verify that managed endpoints receive the updated build.

What Muse users should do

1. Update the Muse Mac app. Install the current production build distributed after Meta's September 22 hotfix.
2. Review connected services and grants. Remove integrations and permissions that are no longer required. Agent impact scales with the access already delegated to it.
3. Investigate suspicious local execution. The attack requires code to run as the user, so endpoint telemetry, persistence findings or malware alerts remain central to incident triage.
4. Rotate credentials when compromise is plausible. If an affected Mac ran untrusted code while Muse was configured with valuable accounts, review sessions and rotate exposed credentials or tokens where the connected service supports it.
5. Keep management paths least-privileged. Enterprise deployments should inventory agent clients, their connected services and their update status just as they would other privileged desktop software.

Why this matters for local AI agents

The incident illustrates a broader engineering requirement for desktop agents: configuration inputs that control trusted network destinations need protection proportionate to the capabilities the agent can exercise. A writable preference can become a high-impact control surface when it sits in front of an assistant with access to files, accounts, communications or other delegated services.

For security teams, the useful model is to treat an agent as a privileged application whose effective blast radius is the union of its local permissions, cloud session credentials and connected-service grants. Endpoint hardening still matters because local execution can become a route into those higher-level capabilities.

Meta's rapid hotfix closes the publicly documented dictation-endpoint path. Public reporting currently describes the disclosed proof of concept and hotfix, with no CVE assigned as of September 23 and no reported broader compromise campaign. The incident therefore provides a concrete agent-client design and permission-management lesson within a local-execution threat model.

Sources

• Patrick Wardle, not-a-mused proof-of-concept and technical description: https://github.com/pwardle/not-a-mused
• Meta, original Muse architecture and security overview, September 8, 2026: https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/
• David Singleton, Meta Superintelligence Labs hotfix statement: https://x.com/dps/status/2102248329111634067
• The Verge, independent report confirming the September 22 hotfix and local-execution prerequisite: https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent