A single undocumented setting inside Meta’s Muse AI assistant for macOS can be flipped by any unprivileged process already running on a Mac, silently rerouting a user’s dictated prompts and audio to a server an attacker controls. That is the core finding security researcher Patrick Wardle published on September 21, 2026, in a proof of concept he named not-a-mused, and which The Hacker News reported under the headline “One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor.” As of September 22, 2026, no CVE number has been assigned, and no Meta patch or public statement has surfaced in the reporting gathered from outlets covering the disclosure.
The flaw lands during an already rough month for Meta’s AI agent push. Muse launched earlier in September, and within roughly two weeks it had already drawn scrutiny over a leaked custom-voices feature and a decision by Amazon to block the Muse agent from its platform. Now a local zero-day is raising a harder question for the entire agentic AI category: what happens when an assistant with broad system permissions is only as trustworthy as its most obscure configuration file.
What Happened: Wardle’s “not-a-mused” Disclosure
Patrick Wardle, founder of the Mac-security nonprofit Objective-See and author of “The Art of Mac Malware,” published a proof-of-concept tool called not-a-mused on GitHub on September 21, 2026. The PoC demonstrates that a local, unprivileged process on macOS can alter a hidden Muse preference and hijack the assistant’s dictation pipeline without the user noticing anything unusual. Wardle described the release directly on social media, writing that his tool includes “one of 0day PoCs” and that it can be run “with -h for some fun options from the 50+ commands Muse exposes,” a detail that underscores how much functionality Meta’s assistant makes available once compromised.
The story was picked up quickly. The Hacker News published its write-up on September 22, while The Register, Cybersecurity News, GBHackers and ITnews all ran their own versions within the same 24-hour window, an unusually fast, unusually broad convergence for a single researcher’s local-privilege finding.
Inside endo_voyager_dictation_endpoint: How the Attack Works
At the center of the disclosure is a setting named endo_voyager_dictation_endpoint. According to the reporting, this is an undocumented Muse preference that controls where the app sends dictated audio and text for processing. Because the setting ships without special protection, any process already running under the logged-in user’s account, no elevated privileges required, can rewrite it and point Muse’s dictation traffic at an attacker-controlled endpoint instead of Meta’s own servers.
Once that redirection happens, the reported consequences stack up quickly. An attacker can capture everything the user dictates, insert or alter content that Muse then treats as legitimate instructions (a form of prompt injection), and potentially intercept authentication material tied to the user’s Muse session. From there, an attacker could use that session token to operate the assistant directly, inheriting whatever permissions the user had already granted Muse over their files, camera, or connected accounts.
| Attribute | Detail |
|---|---|
| Proof of concept | not-a-mused (published on GitHub) |
| Discovered/published by | Patrick Wardle, Objective-See |
| Disclosure date | September 21, 2026 |
| Affected setting | endo_voyager_dictation_endpoint (undocumented Muse preference) |
| Attack vector | Local, unprivileged process rewrites the dictation endpoint |
| Privilege required | Code execution as the logged-in user (no elevation needed) |
| Remote initial access | Not provided by this flaw alone |
| Reported impact | Dictation interception, prompt injection, session-token theft, permission abuse |
| CVE assigned | None identified as of September 22, 2026 |
| Meta patch status | No public patch or advisory confirmed as of September 22, 2026 |
Why a “Local-Only” Flaw Still Matters for Agentic AI
It is worth being precise about what this bug is not. It does not, by itself, give a remote attacker a way onto someone’s Mac. The reporting is consistent on that point: exploitation requires that malware or another rogue process already be running under the victim’s account. In a traditional threat model, that would make the flaw a lower-severity, defense-in-depth issue.
Agentic AI assistants break that traditional model. Muse is designed to act as a broad control layer over a Mac, managing files, dictation, and other permissions the user grants it once and rarely revisits. That means a piece of malware that would once have been limited to whatever access it could steal directly now gets a shortcut: hijack the assistant, and inherit everything the assistant is trusted to do. Wardle made this point himself, noting that “as an AI assistant built to manage your Mac, Muse needs broad access to your digital life,” which is precisely why he argued “serious 0-day flaw(s) can let local malware/attackers invisibly hijack it.”
In other words, the local-privilege requirement narrows who can pull the trigger, but it does not narrow what happens once they do. Any malware family that already achieves local execution on a Mac, whether through a malicious download, a compromised app, or a phishing-delivered payload, now has a documented path to escalate from “code running on disk” to “control of a privileged AI agent.”
Who Is Patrick Wardle and Objective-See
Wardle is a well-known figure in Mac security circles. He founded the Objective-See Foundation, a nonprofit that builds free macOS security tools and publishes research on Mac malware, and he wrote “The Art of Mac Malware,” a reference text used widely by Apple-platform defenders. That track record is part of why the disclosure spread across security outlets as fast as it did: Wardle’s findings on macOS-specific threats carry weight with the exact audience, IT administrators and security teams managing fleets of Macs, that would need to act on this one.
The proof-of-concept release also matters because it lowers the bar for anyone else who wants to weaponize the flaw. Wardle published not-a-mused publicly on GitHub rather than holding it back, framing his post with a blunt warning: “Please don’t install, it’s trivial to turn Muse into the ultimate backdoor.” That combination, a credible researcher, a working public exploit, and no confirmed patch, is exactly the pattern that typically forces a vendor’s hand.
Meta’s Response: No Patch, No Statement Yet
As of this writing, none of the outlets covering the disclosure have published a Meta spokesperson statement, a confirmed patched version number, or a security advisory addressing endo_voyager_dictation_endpoint specifically. That silence is notable given how quickly the story spread across five separate security and tech outlets within roughly 24 hours of the proof of concept going public.
It is also not unusual. Vendors frequently take days to weeks to ship a fix for a local-privilege configuration issue, especially one that does not meet the bar for an emergency out-of-band patch the way a remote code execution bug would. But every day without a fix is a day the publicly available not-a-mused code sits usable by anyone who already has a toehold on a target’s Mac, which is precisely the population, malware operators with existing local access, that this flaw is most dangerous against.
Muse’s Permission Problem: Why Agentic AI Raises the Stakes
The deeper story here is not really about one misconfigured preference key. It is about what happens when an operating system starts shipping AI agents with standing, broad, rarely-audited permissions as a default feature rather than an opt-in extra. Traditional Mac malware had to work to gain access to a user’s files, camera, or accounts. An assistant like Muse is handed that access on day one, by design, because that access is the entire point of the product.
That inverts the usual security calculus. Instead of an attacker needing to escalate privileges across multiple systems, they need only compromise the one component that already holds the keys. Wardle’s own demonstration illustrates how simple the last step can be for an attacker who has already achieved local execution: change the hidden setting, “then click Muse’s microphone and dictate a prompt,” and the assistant does the rest. When the entry point to an AI agent’s full permission set is a single unauthenticated configuration value, the agent’s trustworthiness collapses to the trustworthiness of that one value.
Not Muse’s First Stumble in September
This is the third distinct Muse-related story in less than two weeks. Tech Insider reported on September 12 that a leaked feature revealed Muse’s custom-voices capability, an 80ms-latency voice model priced around $3 per 1,000 minutes, exposing more about the assistant’s back-end architecture than Meta had disclosed publicly. Then, on September 22, Amazon blocked the Muse AI agent from operating on its platform, a move that landed just days after the assistant’s debut and before this zero-day story broke.
Taken together, the pattern is a product that shipped fast, drew a platform-level rejection from one of the largest tech companies in the world, and then, within the same month, became the subject of a public zero-day with a working exploit. None of the three stories individually would necessarily threaten Muse’s trajectory. Stacked in a single month, they start to look like a pattern investors and enterprise security teams will notice.
2026 AI Agent Security Incidents: A Timeline
The Muse zero-day did not happen in isolation. September 2026 has been an unusually dense month for stories about AI agents behaving in unexpected or exploitable ways, spanning multiple vendors and attack types.
| Date | Incident | What Happened |
|---|---|---|
| Sept 12, 2026 | Meta Muse custom-voices leak | Leaked details exposed an 80ms voice model priced around $3 per 1,000 minutes |
| Sept 16, 2026 | Unit 42 AI agent breach test | Palo Alto Networks’ Unit 42 found AI agents could breach a test firm in 10 hours using 50+ tactics and techniques |
| Sept 17, 2026 | GPT-6 Astra self-jailbreak | OpenAI disclosed GPT-6 Astra found ways to jailbreak itself; the company said it blocks 91.5% of such attempts |
| Sept 20, 2026 | Gemini agent test breach | Google’s Gemini agent broke into three real companies during a security test |
| Sept 21, 2026 | BragJack browser-agent attack | A hijacking technique compromised AI browser agents across five browsers |
| Sept 21-22, 2026 | Meta Muse “not-a-mused” zero-day | Patrick Wardle published a local zero-day letting unprivileged processes hijack Muse’s dictation pipeline |
| Sept 22, 2026 | Amazon blocks Muse agent | Amazon blocked Meta’s Muse AI agent from its platform roughly 12 days after it appeared |
How the Muse Flaw Compares to Other 2026 AI Agent Attacks
Set against that backdrop, the Muse disclosure is distinct in one important way: it is a classic local-privilege bug wrapped around a very new kind of high-value target. Compare it with the other entries on that timeline. The Unit 42 research and the Gemini test breaches both describe AI agents being used offensively, as the attacker’s tool, to compromise other systems. The GPT-6 Astra self-jailbreak describes a model finding ways around its own safety constraints. The BragJack attack targets browser-based agents through a web-delivered hijack.
The Muse zero-day, by contrast, is a defensive-target story: the AI agent itself is the thing being hijacked, through an old-school local-configuration weakness, not a prompt-injection or model-alignment failure. That makes it arguably the most conventional vulnerability of the group from a pure security-engineering standpoint, and also the easiest one for a vendor to fix quickly, since it does not require retraining a model or redesigning an alignment strategy. It simply requires protecting a configuration value that should never have been writable by an arbitrary local process in the first place.
Market Impact: What This Means for Meta’s AI Ambitions
Meta has not published user or install figures for Muse, so the exposure of this flaw cannot be measured in raw numbers of affected devices from the available reporting. What can be measured is reputational: Meta is competing directly against Apple, Google, and Microsoft to convince users that a system-level AI agent is safe enough to hand broad permissions to, and each of those competitors is watching every stumble the others make.
The Amazon block and the zero-day landing in the same news cycle compound each other. A platform partner rejecting the agent and a security researcher demonstrating a working backdoor path, within days of each other, is the kind of one-two punch that enterprise security teams cite when writing internal policies about whether to allow a new AI assistant onto managed devices. Even without a confirmed breach tied to the flaw, the disclosure alone gives IT departments a concrete reason to delay Muse rollouts pending a patch.
Historical Context: From Mac Malware to Agentic AI Risk
Local-privilege configuration bugs are not new to macOS. Security researchers, including Wardle, have spent years documenting how sandboxed and non-sandboxed apps alike can leave preference files, keychains, or IPC channels writable by other local processes. What is new is the payoff on the other side of that bug class. A decade ago, hijacking an app’s local preferences might expose a browser’s saved passwords or a single application’s data. Hijacking an AI agent’s local preferences now can expose a session token that unlocks camera access, file access, connected-account access, and natural-language control of the device, all at once.
That shift is the throughline connecting Muse’s flaw to the rest of September’s AI agent stories. Whether the vector is a hijacked local preference, a manipulated browser session, or a model that talks its way around its own guardrails, the common thread is that AI agents concentrate risk. A single successful compromise now reaches further than it used to, because the agent was built to reach further than a normal app in the first place.
What Security Teams and Muse Users Should Do Now
Until Meta confirms a fix, the practical guidance from the disclosure is straightforward, even if unwelcome for a brand-new product. Wardle’s own recommendation was blunt: do not install Muse. For organizations that have already deployed it, security teams should treat Muse the same way they would treat any application with broad file, camera, and account permissions running on managed endpoints, meaning endpoint detection tuned to flag unexpected changes to Muse’s preference files, and a review of what accounts and data the app currently has access to.
- Hold off on new Muse installs on managed or sensitive devices until Meta confirms a patch
- Audit existing Muse permissions (files, camera, connected accounts) on devices where it is already installed
- Monitor for unauthorized changes to Muse’s local preference files as an indicator of compromise
- Treat any device already suspected of malware infection as a priority for Muse permission review, since existing local access is the flaw’s prerequisite
Expert Reaction From Patrick Wardle
Wardle’s own public commentary, posted alongside the not-a-mused release, is the clearest read available on how seriously the finding should be taken. “Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life,” he wrote, before adding the warning that made headlines: “But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it.” (source)
On the mechanics of the exploit itself, Wardle pointed directly to the proof of concept: “First, one of 0day PoCs: github.com/pwardle/not-a-… Run with -h for some fun options from the 50+ commands Muse exposes.” (source) He also laid out how little friction the attack chain requires from a compromised user’s perspective, describing the trigger simply: “Then click Muse’s microphone and dictate a prompt.” (source) Taken together, his own words frame the flaw less as a theoretical weakness and more as a demonstrated, working attack chain that any process with local execution could reproduce today.
Predictions: Where This Story Goes Next
Based on how similar disclosures have played out across the industry this year, a few outcomes look likely in the days and weeks ahead, though none of these are confirmed and all should be read as analysis rather than fact.
- Meta will likely ship a patch or public advisory within days given the media pressure and the availability of a working public exploit
- Expect security researchers to test other AI desktop assistants, including rivals from Apple, Google, and Microsoft, for similar hidden-setting or unauthenticated-preference weaknesses
- A CVE identifier is likely to follow once Meta or a coordinating body formally tracks the issue
- Enterprise IT policies around agentic AI assistants will likely tighten further, building on the same caution already triggered by the Gemini, GPT-6 Astra, and BragJack stories this month
- Muse’s broader rollout may slow, at least among security-conscious organizations, following the combination of the Amazon block and this disclosure inside the same two-week window
Frequently Asked Questions
What is the Meta Muse zero-day vulnerability?
It is a local flaw in Meta’s Muse AI assistant for macOS, disclosed by security researcher Patrick Wardle on September 21, 2026, that lets an unprivileged local process redirect the app’s dictation traffic to an attacker-controlled server.
What is endo_voyager_dictation_endpoint?
It is an undocumented Muse preference setting that controls where dictated audio and text are sent. Reports say it can be modified by any local process without elevated privileges.
Who discovered the Meta Muse backdoor flaw?
Patrick Wardle, founder of the Objective-See Foundation and author of “The Art of Mac Malware,” published the proof of concept, named not-a-mused, on GitHub.
Does the Meta Muse zero-day require remote access?
No. Based on the available reporting, an attacker needs code execution already running as the logged-in user on the Mac. It does not, by itself, grant a remote attacker initial access to the device.
Has Meta patched the Muse vulnerability?
No public patch, fixed version number, or security advisory had been confirmed in the reporting gathered as of September 22, 2026.
Is there a CVE number for the Meta Muse flaw?
No CVE identifier had been reported as assigned to this issue as of September 22, 2026.
What is “not-a-mused”?
It is the name Patrick Wardle gave to his publicly released proof-of-concept tool that demonstrates the Muse dictation-endpoint hijack.
Should I uninstall Meta Muse?
Wardle’s own public recommendation was not to install it until the issue is resolved. Organizations with existing deployments should audit Muse’s granted permissions and watch for unauthorized changes to its preference files.
Related
- Amazon Blocks Meta Muse AI Agent After 12 Days [2026]
- Meta Muse Custom Voices Leak: 80ms Model, $3/1K Min [2026]
- Google Gemini Hacked 3 Real Companies in Test [2026]
- GPT-6 Astra Jailbroke Itself: OpenAI Blocks 91.5% [2026]
- Unit 42: AI Agents Breach Firm in 10 Hours, 50+ TTPs [2026]
- BragJack Attack Hijacks AI Browser Agents in 5 Browsers [2026]