One Undocumented Setting Was Enough to Turn Meta's Muse Into a Dictation Backdoor

On 21 September 2026 security researcher Patrick Wardle published a proof-of-concept called not-a-mused showing that one undocumented preference inside Meta's Muse assistant for macOS decides where the app sends what you dictate. The key is endo_voyager_dictation_endpoint, and any process running as the logged-in user can rewrite it without an administrator password or a macOS prompt. Point it at an address the attacker controls and Muse's audio and transcript go there instead of to Meta; Wardle showed an attacker can then read the dictation, inject instructions Muse obeys, and lift a token that signs in to the user's Muse account — reaching every device where that account is signed in. Meta says it shipped a hotfix the next day. No real-world attack has been reported. The archive's own record of the disclosure, with its severity grading and cited sources, sits in the AI incident archive alongside the other agent-vulnerability entries in this series.

What the setting does, and why one key was enough

Wardle is a co-founder of the nonprofit Objective-See, The Register reports. Muse is Meta's personal agent, launched in the United States earlier in September 2026, and The Hacker News reports that once a user turns it on it can work across their files, email, messages, calendar, shopping and smart-home apps, using whatever access the person chooses to give it. Wardle's finding is not in that access list. It is in the plumbing underneath it: the Mac app ships a setting that routes dictation audio off the device, and the address it routes to is stored where the operating system does not protect it from other programs running as the same user.

In the repository's own words, the proof-of-concept demonstrates that "a local attacker or malware can modify this endpoint without special privileges," after which "dictated prompts can be sent to an attacker-controlled endpoint." The repository lists what that potentially allows: capture of dictated audio and prompts, prompt injection into Muse, theft of Muse authentication material, and abuse of whatever access the user has granted the app. It summarises the consequence in one line: "Muse's access can potentially become the attacker's access." The proof-of-concept implements what its README calls a subset of the 50-plus commands Muse exposes.

The sequence The Hacker News describes is mechanical. A program the attacker runs on the same Mac rewrites the preference, then waits. The user taps the microphone and speaks. The audio and the resulting text go to the attacker's program rather than to Meta. From that position, Wardle demonstrated three things: reading what the user dictated, adding extra instructions that Muse trusts and acts on — the outlet describes the effect as prompt injection — and capturing the token that signs in to the user's Muse account.

A token, and every device behind it

The token is the part that leaves the Mac. The Hacker News reports that Muse sends its authentication token along with the redirected dictation, so the same listener that captures the transcript also captures the credential. With it, Wardle says, an attacker can read the account's chat history and give the assistant orders directly — and because a Muse account can be signed in on several devices, those orders are not confined to the compromised machine.

Wardle ran that part on his own hardware. From the Mac he directed the Muse app on his iPhone to report its exact location, run a Bluetooth scan of nearby devices, and list the smart-home commands it could send. The Hacker News adds one boundary to the demonstration: in his tests the assistant only drafted messages rather than sending them on its own.

That is the argument for treating the bug as more than a dictation leak. The Register reports Wardle's framing of the general problem — that macOS was built to stop one program from reading another's data, and that an agent which has been granted broad access becomes a single point of failure for those controls. "Just because a bad neighbor moves in doesn't mean that that neighbor automatically has access to all the apartments," he told The Register. An assistant that has been given the keys is a different proposition.

What it does not do

Three limits are stated in the sources and matter for anyone assessing exposure. First, the flaw is not a way into a Mac by itself: it needs code already running as the logged-in user, which is why Wardle's repository labels it "a local attack" and Meta later called it a local privilege escalation. Second, it does not defeat macOS application isolation — The Hacker News reports that it does not cross the boundary that stops one app from reading another app's saved passwords and tokens; Muse's own token rides along with the redirected dictation, and the attack works by getting Muse to act with access it already has. Third, it does not show that Meta's cloud design, which the company built to keep each user's agent walled off from others, was broken.

What it does show is why endpoint security may not notice. The Hacker News reports Wardle's point that the commands arrive from Muse, a normal signed application, rather than from something that looks like malware; The Register records the same concern in his words, that an EDR product cannot tell whether a command came from the user, the agent, or an attacker.

Wardle also assigns a cause. The Register reports that Apple provides on-device dictation and that, in his assessment, the vulnerability would not exist had Meta used that API; he suggests Meta chose not to because it wants the data, and adds: "I think some of their greediness for user data kind of opens the door, makes a bigger attack surface." That is his inference about Meta's motive, not a documented fact, and Meta has not responded to it in the coverage reviewed here.

Disclosure, the hotfix, and an argument about the label

Wardle went public without telling Meta first. The Hacker News reports that he chose full disclosure so users would understand the risk and because it is often the fastest route to a fix. The Register, which interviewed him, says Meta did not immediately respond to its request for comment.

The response came the next day, and it came with a characterisation attached. In a social media post on 22 September, David Singleton of Meta Superintelligence Labs said the Muse app had been revised: "This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user's machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low." The post added: "Nonetheless, we have issued a hotfix to the app to address the issue."

On one narrow point the two sides disagree, and the disagreement is about classification rather than mechanism. Singleton's statement rests on the requirement for existing local code. Wardle told The Hacker News that a remote attacker could still get there through a ClickFix trick — the pattern that talks a user into pasting a single command into Terminal, with nothing to download or install — which would supply the local execution the exploit needs. No source reviewed for this article reports that anyone has actually done so, and the ClickFix route is a demonstrated possibility rather than an observed campaign.

What the hotfix changes is not public. The Hacker News reported that it could not confirm what the change does and that Meta had not published a security advisory; the archive's record likewise notes that no advisory has been issued. A Muse user therefore has Meta's word that the issue is addressed, and no document describing how.

What is established, and what is not

The archive grades this record confidence A — well documented, with primary sources that agree — and does not flag it as disputed. That grading is not a claim that harm occurred: the record marks real harm as false, and nothing in the coverage reviewed describes an attacked user, a stolen account or a lost file. The evidence is a researcher's proof-of-concept, his own demonstrations, and a vendor statement.

• Established: the Muse macOS app carried an undocumented preference named endo_voyager_dictation_endpoint that controlled where dictation was sent, and a process running as the logged-in user could rewrite it without elevated rights, per Wardle's repository and both outlets.

• Established: redirecting that endpoint sent dictation audio and transcript to an attacker-controlled address, and Muse's authentication token travelled with it, per The Hacker News.

• Established: a token obtained that way could drive Muse on other devices signed in to the same account; Wardle demonstrated location reporting, a Bluetooth scan and a smart-home command list on his own iPhone, per The Hacker News.

• Established: the attack required code execution as the user, did not defeat macOS application isolation, and did not breach Meta's cloud separation, per The Hacker News and Wardle's repository.

• Established: Wardle disclosed without pre-notifying Meta, and Meta said on 22 September that it had issued a hotfix, per The Register and The Hacker News.

• Not established: what the hotfix changed, whether the preference still exists in current builds, and whether the ClickFix path survives it. No advisory, changelog or CVE entry describing the fix appears in the coverage reviewed.

• Not established: whether anyone was targeted in the wild, and whether the flaw was reachable on any platform other than the macOS app. Every demonstration in the record ran on Wardle's own machines.

• Not established: independent reproduction. Both outlets reported the finding, and The Register interviewed Wardle by phone, but no third party has published its own test of the redirect, and Meta has not described the flaw in its own words beyond Singleton's classification.

The interim advice, and what generalises

While the fix was unconfirmed, The Hacker News published a short list of precautions for Mac users, and it is worth recording because it maps the exposure precisely. Quit or remove Muse, which closes the path entirely. Review the apps and permissions Muse holds and revoke anything it does not need, so that a hijacked agent inherits less. Treat the Muse account and the accounts connected to it as exposed if the Mac may already be compromised, and change those passwords. Avoid Muse's voice input, which is the specific trigger the proof-of-concept waits for. And do not run commands that a website or a message tells you to paste into Terminal, which is how the ClickFix path begins.

The transferable finding is smaller than "AI is insecure" and sharper than "patch your apps." An agent's usefulness and its blast radius are the same number: the permissions that let Muse read files and send messages are the permissions an attacker inherits by steering it, and no control it passed was itself defeated. macOS kept its app boundary, Meta's cloud kept its separation, and the token was not lifted from a keychain. A preference that should have been inert was load-bearing, and it sat outside every layer built to guard the data it pointed at. Wardle's own summary of the design trade-off, given to The Register, is the one that outlives the patch: "They're super convenient and super empowering. But they have so much access if you configure them to be useful. They basically could do anything on your computer."