# Meta Muse Mac Zero-Day: An Undocumented Setting Let Local Malware Hijack Prompts and Reach a Linked iPhone

> Security researcher Patrick Wardle (Objective-See Foundation) disclosed a local zero-day in Meta's Muse Mac client, published as the proof-of-concept "not-a-mused." An undocumented setting lets any unprivileged local process redirect Muse's dictated prompts to an attacker-controlled server, capture the agent's auth material, and pivot to a linked iPhone. What the flaw does, how it works, its real prerequisites, and what it means for anyone deploying AI agents with cross-device reach.

Source: https://playciso.com/blog/meta-muse-mac-zero-day-not-a-mused-linked-iphone · Published: 2026-09-21 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://github.com/pwardle/not-a-mused

---

**Full credit up front:** the vulnerability described here was found and disclosed by **Patrick Wardle**, founder of the [Objective-See Foundation](https://objective-see.org/) and one of the most respected independent macOS security researchers working today. The proof of concept, **not-a-mused**, is published on his GitHub at [github.com/pwardle/not-a-mused](https://github.com/pwardle/not-a-mused) — read that for the primary source and technical detail. We're covering it because it is a sharp, concrete example of a risk every security leader evaluating AI agents needs to price in: what happens when an agent's convenience feature — reaching your other devices — becomes reachable by anyone already on the box. ## What Muse is Muse is Meta's personal AI agent, launched publicly on **September 8, 2026**. It is built to act on a user's behalf — browsing websites, filling in forms, sending emails, making purchases — across mobile, web and, since a dedicated client shipped on **September 17**, the Mac. That combination — real-world permissions plus reach across a user's whole device set — is exactly what makes a local flaw in it worth more attention than a typical single-app bug. ## The flaw, in plain terms Wardle's research found that the Mac client exposes an **undocumented setting**, `endo_voyager_dictation_endpoint`, that controls where the app sends dictated prompts. Critically, that setting can be changed by **any unprivileged local process** — no special permissions required. Point it at a server you control, and the app will dutifully route what the user says straight to you. From there, the proof of concept demonstrated a short, damaging chain: - Intercept dictation audio and prompts by redirecting the endpoint. - Capture Muse's own authentication material in transit. - Use the agent's legitimate cross-device design to enumerate and reach a linked iPhone. - Query the iPhone's location and run Bluetooth Low Energy scans against it remotely. Nothing in that chain is a novel exploitation primitive — no memory corruption, no sandbox escape. It is a design flaw: a sensitive routing setting with no access control, sitting inside an app that was deliberately built to reach across a user's devices. That combination is what turns "a local process can change a setting" into "a local process can locate your phone." ## What it requires — and why that still matters This is a **local** zero-day: the attacker needs to already be executing code as the Mac user. It is not a drive-by, remote compromise of an untouched machine. That is a real and important caveat — but it is not much comfort. "Already has local code execution" describes a large share of real-world Mac compromises: a malicious app, a compromised dependency, a phishing-delivered payload, or any other foothold. The question a defender should ask is never just "does this need local access," it's **"what does local access turn into once it has it."** Here, it turns into your phone's location. ## The pattern worth generalizing This is not really a story about one undocumented setting. It's a preview of a category of risk that is going to keep showing up as AI agents get wired into more of a user's real accounts, devices and permissions: an agent that is _useful_ because it can reach across your phone, your email, your calendar and your wallet is, by the same design, a single point that turns a local foothold on any one device into reach across all of them. We've written before about how [agent hijacking](/blog/ai-agent-hijacking-attacks-enter-evade-escape) and [computer-use agents](/blog/ai-computer-use-malware-analysis-dfir-automation) expand what a single compromise can do — this is the same shape of problem, just showing up in a mainstream consumer AI product instead of a research demo. ## What security leaders should take from this - Inventory cross-device AI agents. Do you know which AI assistants your users — or your executives — have linked across their laptop and phone, and what those links can reach? - Treat "settings" as attack surface. A configuration value with no access control is a vulnerability even without memory corruption. Any app that lets a local, unprivileged process change where it sends sensitive data needs that path locked down. - Assume local compromise happens. Design and evaluate agent permissions for what they let a local foothold reach — not just for whether a remote attacker can get in. - Scope agent permissions deliberately. An agent that can browse, email, buy and reach a linked phone is powerful and correspondingly high-blast-radius if compromised. Question whether every permission it holds is actually needed. - Watch for a patch, and don't assume BYOD is out of scope. Personal AI agents on personal devices still touch corporate accounts through email and browser sessions. This class of consumer-AI vulnerability belongs on the same watch-list as any other client software your users run. ## Frequently asked questions ### What is Meta Muse? Muse is a personal AI agent Meta launched publicly on September 8, 2026, designed to browse websites, fill in forms, send emails and make purchases on a user's behalf across mobile, web and desktop clients. A dedicated Mac client followed on September 17, 2026. ### What is the not-a-mused vulnerability? It is a local zero-day in Muse's Mac client, disclosed by researcher Patrick Wardle on September 21, 2026 and published as a proof of concept called "not-a-mused." The Mac client exposes an undocumented setting, `endo_voyager_dictation_endpoint`, that an unprivileged local process can modify without special permissions to redirect the app's dictated prompts to a server the attacker controls. ### What can an attacker actually do with it? Wardle's proof of concept intercepted dictated prompts, captured Muse's own authentication material, and then used the agent's legitimate cross-device access to reach a linked iPhone — querying its location and initiating Bluetooth Low Energy scans. It turns a local compromise of the Mac into remote reach against a paired phone, using permissions the agent already legitimately holds. ### Does this require remote access, or can it be exploited over the internet? It requires local code execution first — the attacker must already be able to run code as the Mac user. It is not a drive-by, network-based compromise of an otherwise untouched machine, but "already has local code execution" describes a large share of real-world Mac compromises. ### Has Meta patched it? As of publication, there is no confirmed patch, advisory or CVE for the issue. This article reflects the details in Wardle's public proof-of-concept repository at the time of writing; check the repository and Meta's own channels for the current status. PlayCISO is not affiliated with Meta, Muse, Patrick Wardle or the Objective-See Foundation. This article is an independent summary based on Wardle's public proof-of-concept repository and public reporting at the time of writing; details may change as Meta responds and as the disclosure develops. **Evaluating AI agents with device or account permissions?** Threat-model the agent's blast radius with the free [Threat Model Generator](/tools/threat-model), work through the [OWASP LLM Top 10](/tools/llm-security), and rehearse the incident where an agent's permissions get abused in the [Cyber War Room](/warroom). No signup.