Researcher shows Meta Muse flaw can hijack dictation on macOS

Security researcher Patrick Wardle has disclosed what he calls a local zero-day in Meta's Muse app for macOS, showing that an unprivileged process already running on a Mac can redirect the AI assistant's dictation traffic to a server of the attacker's choosing. The disclosure and a proof-of-concept tool named not-a-mused were reported by The Register on 21 September 2026. Meta did not immediately respond to the publication's request for comment.

According to Wardle's project repository, as described by The Register, Muse has an undocumented setting called endo_voyager_dictation_endpoint. An attacker running code locally can modify that setting without special privileges. Doing so sends dictation traffic to an attacker-controlled endpoint, potentially exposing dictated audio and the prompts that would normally go to Meta's backend AI model. Wardle said the flaw could also enable prompt injection, in which text supplied by an attacker is treated as instructions by the model, along with the theft of authentication material and abuse of whatever access the user has granted to Muse.

The issue cannot be exploited remotely. It requires the ability to run code on the machine already, which makes it in effect a privilege escalation bug, according to Wardle. His concern is what that escalation buys an intruder: local malware gains far broader access than it would otherwise have, because it inherits the permissions the user handed to the assistant.

Speaking to The Register by phone, Wardle, who founded the nonprofit Objective-See, compared macOS security to an apartment building. "Just because a bad neighbor moves in doesn't mean that that neighbor automatically has access to all the apartments," he said. He credited Apple with doing "a really good job" on privilege separation and on its Transparency, Consent, and Control framework, which governs access to sensitive data on macOS. His worry is that AI apps undo those barriers because they request or require so much access to data and tools. "They're super convenient and super empowering. But they have so much access if you configure them to be useful. They basically could do anything on your computer," he said, describing such apps as a potential single point of failure that breaks operating system security controls.

Wardle also questioned whether AI vendors are turning their own bug-finding models on their own software. "You know these AI companies have really great AI models for finding bugs," he said. "Are they not running them against [their own apps]? Is the priority not the security of their own apps?"

He argued that endpoint detection and response tools have improved on macOS because code is signed and unnotarised processes stand out, but that broadly permissioned agents blunt this: the software cannot tell whether commands come from the user, the agent or an attacker.

Wardle noted that Apple offers on-device local dictation, and said the vulnerability would not exist had Meta used that API. He suggested Meta chose otherwise because it wants access to the data. Meta promoted Muse's security at launch earlier this month, citing its reliance on Muse Secure VM and saying each person "decides how much access it gets", The Register reported.