Meta Muse Mac Zero-Day: An Undocumented Setting Let Local Malware Hijack Prompts and Reach a Linked iPhone
On September 21, 2026, security researcher Patrick Wardle — founder of the Objective-See Foundation and a well-known macOS security researcher — disclosed a local zero-day in the Mac client for Meta's Muse, a personal AI agent Meta launched publicly on September 8, 2026 that can browse websites, fill in forms, send emails and make purchases on a user's behalf across mobile, web and desktop. Wardle published a proof of concept, "not-a-mused" (github.com/pwardle/not-a-mused), showing that the Mac client exposes an undocumented setting, endo_voyager_dictation_endpoint, that any unprivileged local process can modify to redirect the app's dictated prompts to an attacker-controlled server. From there, the PoC captured Muse's authentication material and used the agent's own cross-device design to reach a linked iPhone — querying its location and running Bluetooth Low Energy scans. The attack requires an adversary to already have code execution as the local user; it is not a remote, drive-by compromise of an untouched Mac. As of publication there is no confirmed patch or CVE. The real lesson is not this one setting — it is what happens when an AI agent with real-world permissions (email, purchases, a linked phone) becomes reachable from any process already running on the box.
Full credit up front: the vulnerability described here was found and disclosed by Patrick Wardle, founder of the Objective-See Foundation and one of the most respected independent macOS security researchers working today. The proof of concept, not-a-mused, is published on his GitHub at github.com/pwardle/not-a-mused — read that for the primary source and technical detail. We're covering it because it is a sharp, concrete example of a risk every security leader evaluating AI agents needs to price in: what happens when an agent's convenience feature — reaching your other devices — becomes reachable by anyone already on the box.
What Muse is
Muse is Meta's personal AI agent, launched publicly on September 8, 2026. It is built to act on a user's behalf — browsing websites, filling in forms, sending emails, making purchases — across mobile, web and, since a dedicated client shipped on September 17, the Mac. That combination — real-world permissions plus reach across a user's whole device set — is exactly what makes a local flaw in it worth more attention than a typical single-app bug.
The flaw, in plain terms
Wardle's research found that the Mac client exposes an undocumented setting, endo_voyager_dictation_endpoint, that controls where the app sends dictated prompts. Critically, that setting can be changed by any unprivileged local process — no special permissions required. Point it at a server you control, and the app will dutifully route what the user says straight to you.
From there, the proof of concept demonstrated a short, damaging chain:
- Intercept dictation audio and prompts by redirecting the endpoint.
- Capture Muse's own authentication material in transit.
- Use the agent's legitimate cross-device design to enumerate and reach a linked iPhone.
- Query the iPhone's location and run Bluetooth Low Energy scans against it remotely.
Nothing in that chain is a novel exploitation primitive — no memory corruption, no sandbox escape. It is a design flaw: a sensitive routing setting with no access control, sitting inside an app that was deliberately built to reach across a user's devices. That combination is what turns "a local process can change a setting" into "a local process can locate your phone."
What it requires — and why that still matters
This is a local zero-day: the attacker needs to already be executing code as the Mac user. It is not a drive-by, remote compromise of an untouched machine. That is a real and important caveat — but it is not much comfort. "Already has local code execution" describes a large share of real-world Mac compromises: a malicious app, a compromised dependency, a phishing-delivered payload, or any other foothold. The question a defender should ask is never just "does this need local access," it's "what does local access turn into once it has it." Here, it turns into your phone's location.
The pattern worth generalizing
This is not really a story about one undocumented setting. It's a preview of a category of risk that is going to keep showing up as AI agents get wired into more of a user's real accounts, devices and permissions: an agent that is useful because it can reach across your phone, your email, your calendar and your wallet is, by the same design, a single point that turns a local foothold on any one device into reach across all of them. We've written before about how agent hijacking and computer-use agents expand what a single compromise can do — this is the same shape of problem, just showing up in a mainstream consumer AI product instead of a research demo.
What security leaders should take from this
- Inventory cross-device AI agents. Do you know which AI assistants your users — or your executives — have linked across their laptop and phone, and what those links can reach?
- Treat "settings" as attack surface. A configuration value with no access control is a vulnerability even without memory corruption. Any app that lets a local, unprivileged process change where it sends sensitive data needs that path locked down.
- Assume local compromise happens. Design and evaluate agent permissions for what they let a local foothold reach — not just for whether a remote attacker can get in.
- Scope agent permissions deliberately. An agent that can browse, email, buy and reach a linked phone is powerful and correspondingly high-blast-radius if compromised. Question whether every permission it holds is actually needed.
- Watch for a patch, and don't assume BYOD is out of scope. Personal AI agents on personal devices still touch corporate accounts through email and browser sessions. This class of consumer-AI vulnerability belongs on the same watch-list as any other client software your users run.
Frequently asked questions
What is Meta Muse?
Muse is a personal AI agent Meta launched publicly on September 8, 2026, designed to browse websites, fill in forms, send emails and make purchases on a user's behalf across mobile, web and desktop clients. A dedicated Mac client followed on September 17, 2026.
What is the not-a-mused vulnerability?
It is a local zero-day in Muse's Mac client, disclosed by researcher Patrick Wardle on September 21, 2026 and published as a proof of concept called "not-a-mused." The Mac client exposes an undocumented setting, endo_voyager_dictation_endpoint, that an unprivileged local process can modify without special permissions to redirect the app's dictated prompts to a server the attacker controls.
What can an attacker actually do with it?
Wardle's proof of concept intercepted dictated prompts, captured Muse's own authentication material, and then used the agent's legitimate cross-device access to reach a linked iPhone — querying its location and initiating Bluetooth Low Energy scans. It turns a local compromise of the Mac into remote reach against a paired phone, using permissions the agent already legitimately holds.
Does this require remote access, or can it be exploited over the internet?
It requires local code execution first — the attacker must already be able to run code as the Mac user. It is not a drive-by, network-based compromise of an otherwise untouched machine, but "already has local code execution" describes a large share of real-world Mac compromises.
Has Meta patched it?
As of publication, there is no confirmed patch, advisory or CVE for the issue. This article reflects the details in Wardle's public proof-of-concept repository at the time of writing; check the repository and Meta's own channels for the current status.
PlayCISO is not affiliated with Meta, Muse, Patrick Wardle or the Objective-See Foundation. This article is an independent summary based on Wardle's public proof-of-concept repository and public reporting at the time of writing; details may change as Meta responds and as the disclosure develops.
Ready to practise the decisions these articles describe?
Run a free War Room →