Any local process can rewrite the dictation endpoint in Meta's new Muse assistant
Patrick Wardle published working code that sends Muse's dictated audio to a server of the attacker's choosing. Because the assistant holds file, microphone, camera, calendar and paired-iPhone access, whoever redirects it inherits all of it.
The Watch · Security desk
What happened
- Patrick Wardle published proof-of-concept code for a zero-day he dubbed "not-a-mused" that turns Meta's new Muse AI assistant for Mac into a backdoor.
- The undocumented setting endo_voyager_dictation_endpoint can be changed by any local process at ordinary user privileges, sending dictated audio to a server the attacker controls.
- The accompanying code says the redirect allows captured prompts, prompt injection into the assistant, and theft of its authentication material.
- A follow-up post on September 21 showed a compromised session tasking a linked iOS Muse client for an iPhone's location, nearby Bluetooth devices, contacts, calendars and reminders.
- Wardle said he will release further detail and further bugs at the Objective by the Sea conference in November.
Why it matters
- Who's exposed exposure One user-level foothold on a Mac now reaches a phone that was never itself compromised, so the scope of a macOS infection has to be drawn around the paired iOS device too.
- What's now possible capability Post-exploitation code inherits microphone, camera, files, location and calendar access without asking for any of it, because the assistant already holds the permissions an intruder would otherwise have to win.
- What doesn't add up contradiction Meta calls Sentinel the sole authority for network egress; Wardle's exploit sets the audio destination from an unprivileged process, and the two accounts of that control point conflict.
- Who has to decide decision No fix has been reported, so endpoint teams choose between blocking the installer and monitoring a configuration value whose name is public only because a researcher published it.
Next story · Product · Oct 4
Apple will make Mac users take 'very explicit' action before AI agents get Full Disk AccessConfirmed22 publishers
Exploitability turns on one precondition. Wardle said the proof of concept is a local attack, one that assumes an attacker can already run code on the machine as the user [7].
What it buys after that foothold is access Muse already holds. Muse asks for reach across files, microphone, camera, location and calendar [9]. Wardle argues the assistant is a disproportionately valuable target because something built to manage a Mac holds far broader access than typical malware would arrive with [8]. "Muse's access can potentially become the attacker's access," the exploit's documentation stated [10]. Mark Zuckerberg has promoted Muse as a personal agent that works around the clock on a user's behalf [12].
The trigger is mundane: the user clicks the microphone and dictates a prompt as they normally would [6]. The chain runs at the privileges the attacker already has, and the only thing the user approves is the dictation they meant to do anyway [16].
Meta said Muse uses isolated execution, least-privilege access, and a dedicated security layer called Sentinel, which the company described as the sole authority for connector actions and network egress [11]. The dictation destination is network egress, and Wardle's code sets it from an unprivileged local process [18]. iTnews did not report a Meta response to the disclosure.
The reach stops short in one place. Messaging, in Wardle's follow-up, only prepared a draft instead of sending silently [14].
No patch has been reported. What is left is the researcher's own advice. "Please don't install," he wrote. "It's trivial to turn Muse into the ultimate backdoor" [3]. Wardle founded the Objective-See Foundation and wrote The Art of Mac Malware, and he put the exploit on GitHub alongside the thread [2]. Fleets without Muse deployed have nothing here to remediate, since the exposure arrives with the installer.
This is the second time this year that a broadly entitled agent has drawn this kind of warning. OpenClaw, then called Clawdbot, prompted warnings from companies and security researchers over the risks of giving an AI agent broad access to a user's computer, files and accounts [17].
What to watch
- Whether Meta makes the dictation endpoint unwritable by local processes or routes it through Sentinel.
- Any Meta statement or CVE assignment for endo_voyager_dictation_endpoint.
- Whether commodity macOS stealers add the endpoint rewrite to their post-exploitation steps.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence65
Perspective Coverage
3 publishers- Builder
- Builder 33%
- Operator
- Operator 54%
- Investor
- Investor 13%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Patrick Wardle published proof-of-concept code for a zero-day, dubbed "not-a-mused", that can turn Meta's Muse AI assistant into a backdoor.
- [2]
Wardle, founder of the Objective-See Foundation and author of The Art of Mac Malware, disclosed the flaw in a thread on X accompanied by a working exploit on GitHub.
- [3]
"Please don't install," he wrote. "It's trivial to turn Muse into the ultimate backdoor."
- [4]
The undocumented Muse setting endo_voyager_dictation_endpoint could be changed by any local process without elevated privileges, redirecting dictated audio to an attacker's server.
- [5]
Once the endpoint is redirected, dictated audio is sent to an attacker's server instead of Meta's, which the accompanying code says can allow captured prompts, prompt injection into the assistant, and theft of its authentication material.
- [6]
The trigger is mundane, requiring only that a user click the microphone and dictate a prompt as they normally would.
- [7]
Wardle said the proof of concept is a local attack, one that assumes an attacker can already run code on the machine as the user.
- [8]
Wardle argues Muse is a disproportionately valuable target because an assistant built to manage a Mac holds far broader access than typical malware would arrive with.
- [9]
To function, Muse asks for reach across files, microphone, camera, location and calendar.
- [10]
"Muse's access can potentially become the attacker's access," the exploit's documentation stated.
- [11]
Meta said the system uses isolated execution, least-privilege access, and a dedicated security layer called Sentinel, which Meta described as the sole authority for connector actions and network egress.
- [12]
Company founder Mark Zuckerberg promoted the AI assistant as a personal agent that works around the clock on a user's behalf.
- [13]
A follow-up post dated September 21, 2026 extended the concern to linked mobile devices, showing actions that could be requested through a compromised session, including retrieving an iPhone's location, scanning for nearby Bluetooth devices, and accessing contacts, calendars and reminders.
- [14]
Messaging, by contrast, only prepared a draft rather than sending silently.
- [15]
Wardle said he would share further detail and further bugs at the Objective by the Sea security conference in November.
- [16]
The redirect requires no privilege escalation and no user approval beyond the normal dictation click the user was already going to make.
- [17]
Earlier this year, the viral OpenClaw, then known as Clawdbot, prompted warnings from companies and security researchers over the risks of giving an AI agent broad access to a user's computer, files and accounts.
- [18]
Meta's description of Sentinel as the sole authority for network egress and Wardle's finding that an unprivileged local process can set the dictation destination describe the same function differently.
Sources
3 independent publishers whose own reporting we read for this story.
- itnews.com.auSecurity researcher says don't install Meta's Muse AI assistant - iTnews
1 article · September 21, 2026
- malwarebytes.comMeta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor
1 article · September 22, 2026
- thehackernews.comOne Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor
2 articles · September 22, 2026
Topics and entities
Entities
- ClickFix
- Muse
- Mark Zuckerberg
- OpenClaw
- OWASP
- Meta
- Objective-See Foundation
- Patrick Wardle
- Objective by the Sea