Meta Muse Zero-Day Explained: Can the AI Agent Be Hijacked?

Meta's Muse is an AI agent that can send emails, book travel, and shop online on your behalf. Because it holds those permissions, security researchers have been watching it closely. On September 21, 2026, prominent macOS security researcher Patrick Wardle disclosed a local zero-day vulnerability in the macOS version of Muse that could let malicious code already on your machine intercept what you dictate to the agent and potentially abuse the access Muse already has.

Here is what happened, how the attack works at a high level, what could be exposed, and what Muse users should do.

What Happened to Meta Muse?

On September 21, 2026, Patrick Wardle, a well-known macOS security researcher at Jamf (formerly Objective-See), published a proof-of-concept on GitHub describing a local zero-day vulnerability in Meta's Muse AI agent.

The PoC, titled "not-a-mused," demonstrates that an unprivileged local process on a Mac can modify an undocumented Muse configuration setting called endo_voyager_dictation_endpoint. By redirecting that endpoint, an attacker can route the victim's voice-dictated prompts to an attacker-controlled server instead of Meta's own servers.

Importantly, Wardle explicitly frames this as a local attack — not a remote internet exploit. The attacker must already be able to run code on the victim's Mac under the same user account.

Meta has acknowledged and patched the specific vulnerability described. On September 22, 2026 — one day after Wardle's public disclosure — Meta issued a hotfix, which Wardle confirmed on X with the message "Hooray, hot-fixed!" The fix addressed the endpoint-redirect issue in the macOS Muse app.

What Is Meta Muse?

Muse is Meta's personal AI agent, launched on September 8, 2026 for US users. Unlike a chatbot, Muse takes actions: it can send emails, book travel, fill out forms, convert Instagram recipe reels into grocery lists, and make purchases through Stripe Link.

Muse is designed to operate within the broader class of personal AI agents, which hold permissions across email, calendar, files, and connected services. That broad access is what makes a local exploit like this one more consequential than a typical macOS bug.

What Is the Muse Zero-Day?

The vulnerability centers on an undocumented preference key inside Muse:

endo_voyager_dictation_endpoint

This setting controls where Muse sends audio when a user activates voice dictation. Wardle found that this endpoint URL is stored in a location that any local process can modify without elevated privileges.

By redirecting it to an attacker-controlled server, the PoC demonstrates that:

• Dictated audio and text are sent to the attacker instead of Meta's servers
• The attacker can receive prompts that the user intended for Muse
• Muse's session tokens and authentication material may be exposed to the attacker
• Any permissions Muse holds could potentially be abused via the redirected interface

How the Attack Works

Here is the conceptual attack chain at a high level — no operational exploit details are reproduced:

1. Local code execution. The attacker has already placed malware (or any local process) running as the victim user on the Mac.
2. Endpoint modification. The malware modifies the undocumented endo_voyager_dictation_endpoint setting inside Muse's preference store, pointing it to an attacker-controlled URL.
3. Dictation trigger. The victim opens Muse and uses voice input — for example, dictating a question or command.
4. Traffic interception. Instead of reaching Meta's servers, the audio and transcribed prompt are sent to the attacker's endpoint.
5. Access amplification. With the victim's prompts and potentially Muse's session tokens, the attacker may attempt to invoke actions using the permissions already granted to Muse.

This is not a vulnerability in Muse's server infrastructure. It is a local trust-boundary issue in how the macOS client stores a configuration value.

What Could an Attacker Potentially Access?

The impact depends on two factors: what permissions the user has granted Muse, and what services Muse is connected to.

At minimum, an attacker who successfully redirects dictation traffic can:

• Capture dictated prompts: Everything the user says to Muse is intercepted.
• Inject prompts: The attacker can return text that appears to come from Muse.
• Potentially steal session tokens: Authentication material bound to the Muse app could be exposed.

If Muse has been granted access to email, calendars, or purchasing — and the attacker can abuse those tokens or sessions — the consequences could extend further. Wardle stresses that the core concern is privilege amplification: an attacker who already has local code execution gains a foothold inside an app that has been trusted with broader permissions.

We did not find public evidence that any user has been compromised through this flaw as of publication.

Is This a Remote Mac Hack?

No. This is a local vulnerability.

To exploit it, an attacker must already be able to run code on the victim's Mac as the same user who runs Muse. This could happen through:

• Malware the user accidentally installed
• A malicious app downloaded outside the App Store
• Any other local code-execution foothold

This is not a remote code execution vulnerability. An attacker cannot trigger it simply by sending you a link or message over the internet. The vulnerability is in how the macOS version of Muse stores a local configuration setting — not in Meta's backend infrastructure.

If you have not installed untrusted software on your Mac and you keep Gatekeeper enabled, the practical risk from this specific flaw is limited.

Meta's Response and Hotfix

On September 22, 2026 — just one day after the public disclosure — Meta released a hotfix for the endpoint-redirect vulnerability described in Wardle's proof-of-concept. The researcher confirmed the patch on X, writing "Hooray, hot-fixed!" and praising the speed of the response.

Standard practice for security researchers disclosing vulnerabilities is:

1. Report to the vendor privately
2. Vendor prepares a fix
3. Researcher withholds public PoC details until a patch is available
4. Both coordinate a public disclosure date

In this case, Wardle chose full public disclosure — publishing his PoC on GitHub first, then confirming Meta's hotfix the following day. The patch was confirmed via his X account with the message "Hooray, hot-fixed!"

With the hotfix now in place, the key takeaway for users is simple: update Muse immediately and keep it updated.

What Muse Users Should Do

1. Update Muse immediately. Install the latest version from muse.ai or the Mac App Store to ensure you have Meta's September 22 hotfix.
2. Avoid untrusted software. Only install applications from the Mac App Store or from verified developer websites. Keep Gatekeeper enabled.
3. Review app permissions. In System Settings → Privacy & Security, review what Muse (and other AI agents) can access — email, calendar, camera, microphone, files.
4. Keep macOS updated. Apple releases security patches on a regular cadence; staying current helps reduce your overall attack surface.
5. Use a reputable endpoint scanner. If you suspect your machine has been compromised, run a scan with a trusted anti-malware tool.
6. Monitor for suspicious activity. Check your connected email and calendar accounts for unusual sends, drafts, or bookings.

Why This Matters for AI Agents

The broader lesson from the Muse vulnerability is not about Meta — it is about the security model of personal AI agents as a category.

Traditional web services operate in a sandbox: a web browser limits what a malicious website can do. But AI agents like Muse exist on your machine, with your permissions. If that machine is already compromised, the attacker inherits everything the agent can do.

As the token-theft techniques used against AI subscribers demonstrate, the attack surface for AI agents is expanding. Every new permission an agent holds — email, calendar, payments — is a new avenue for abuse if the local environment is not trusted.

This is why security researchers and companies are calling for a principle of least privilege for AI agents: grant only the minimum permissions needed, treat local code execution as a serious risk, and build agents so that a compromise is contained rather than amplified.

Frequently asked questions

Sources & further reading

• Patrick Wardle, not-a-mused (GitHub) — proof-of-concept and technical writeup
• Meta Muse AI Agent Launch Explained — how Muse works and its Secure VM architecture
• What Are AI Agents? Explained — the security implications of agentic AI

Related articles

Comments