ThinkFacility

News

One undocumented Muse setting lets local malware redirect your dictation, and Patrick Wardle shipped the exploit

Wardle told people not to install Meta's Mac agent, four days after Mark Zuckerberg announced it himself.

On September 21, 2026, Patrick Wardle published working exploit code against Meta's Muse on the Mac, and led with the advice rather than the write-up: don't install it. He calls the proof of concept not-a-mused.

Muse for Mac had been out four days. Mark Zuckerberg announced it himself on September 17, 2026, and both his post and the product page lean on how much of your machine the agent is allowed to touch.

Mark Zuckerberg@finkd

Muse for Mac is out today! It works across apps, files, calendar, notes, and messages on your computer. You control what it can access. The team is shipping fast. Download at

View the post on X
Product
Muse for Mac, from Meta
The flaw
a local Muse vulnerability 0day
The setting
endo_voyager_dictation_endpoint, undocumented
Privileges needed
a local attacker or malware can modify this endpoint without special privileges
Proof of concept
not-a-mused
Commands Muse exposes
50+

One undocumented setting

Muse sends the audio of what you dictate off to an endpoint, and the address of that endpoint sits in a setting called endo_voyager_dictation_endpoint. It isn't documented. Any local process can change it without special privileges, and once it's changed, the dictation lands on a server the attacker runs. What surprised me is that the destination is a writable setting at all.

Wardle's README lists what opens up from there. The attacker captures the audio and the prompts, injects prompts of their own into Muse, takes Muse's authentication material, and uses whatever access you granted the agent in the first place.

What that access covers is in Zuckerberg's own announcement: apps, files, calendar, notes and messages on your computer. That's the list an attacker inherits when the agent does the asking.

In short: Muse’s access can potentially become the attacker’s access

From GitHub

The limit Wardle puts on it

This is a local attack, and he says so in plain type: someone has to be running code as you before any of it starts. What makes Muse worth the trouble, on his reading, is that the agent may hold far wider access than the malware already on the machine, so hijacking it upgrades what an attacker has. The code covers a subset of the fifty-plus commands he says Muse exposes.

Patrick Wardle@patrickwardle

Please don't install - it's trivial to turn Muse into the ultimate backdoor 💀👀 Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life. But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it. Let me show you. 🧵

View the post on X

Where it stands

Neither his post nor the repository names a fix or a CVE number for this. Muse's own page, meanwhile, sells the approval step.

Approve actions your agent takes on your behalf before they happen, like sending emails and making purchases

From Muse — Your Personal AI Agent

That promise wraps around what the agent does for you, and the same page offers a complete audit trail of everything it does. The dictation endpoint sits earlier than any of that, on the way in.

Setting the exploit off takes one thing from the person at the keyboard, and it's small. Wardle's instructions say to click the microphone button in Muse and dictate a prompt.