One undocumented Muse setting lets local malware redirect your dictation, and Patrick Wardle shipped the exploit
Wardle told people not to install Meta's Mac agent, four days after Mark Zuckerberg announced it himself.
On September 21, 2026, Patrick Wardle published working exploit code against Meta's Muse on the Mac, and led with the advice rather than the write-up: don't install it. He calls the proof of concept not-a-mused.
Muse for Mac had been out four days. Mark Zuckerberg announced it himself on September 17, 2026, and both his post and the product page lean on how much of your machine the agent is allowed to touch.
Muse for Mac is out today! It works across apps, files, calendar, notes, and messages on your computer. You control what it can access. The team is shipping fast. Download at
- Product
- Muse for Mac, from Meta
- The flaw
- a local Muse vulnerability 0day
- The setting
- endo_voyager_dictation_endpoint, undocumented
- Privileges needed
- a local attacker or malware can modify this endpoint without special privileges
- Proof of concept
- not-a-mused
- Commands Muse exposes
- 50+
One undocumented setting
Muse sends the audio of what you dictate off to an endpoint, and the address of that endpoint sits in a setting called endo_voyager_dictation_endpoint. It isn't documented. Any local process can change it without special privileges, and once it's changed, the dictation lands on a server the attacker runs. What surprised me is that the destination is a writable setting at all.
Wardle's README lists what opens up from there. The attacker captures the audio and the prompts, injects prompts of their own into Muse, takes Muse's authentication material, and uses whatever access you granted the agent in the first place.
What that access covers is in Zuckerberg's own announcement: apps, files, calendar, notes and messages on your computer. That's the list an attacker inherits when the agent does the asking.
In short: Muse’s access can potentially become the attacker’s access
The limit Wardle puts on it
This is a local attack, and he says so in plain type: someone has to be running code as you before any of it starts. What makes Muse worth the trouble, on his reading, is that the agent may hold far wider access than the malware already on the machine, so hijacking it upgrades what an attacker has. The code covers a subset of the fifty-plus commands he says Muse exposes.
Please don't install - it's trivial to turn Muse into the ultimate backdoor 💀👀 Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life. But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it. Let me show you. 🧵
Where it stands
Neither his post nor the repository names a fix or a CVE number for this. Muse's own page, meanwhile, sells the approval step.
Approve actions your agent takes on your behalf before they happen, like sending emails and making purchases
That promise wraps around what the agent does for you, and the same page offers a complete audit trail of everything it does. The dictation endpoint sits earlier than any of that, on the way in.
Setting the exploit off takes one thing from the person at the keyboard, and it's small. Wardle's instructions say to click the microphone button in Muse and dictate a prompt.