A newly disclosed zero-day vulnerability in Meta’s Muse, the company’s AI assistant for macOS, shows how much trust modern AI agents are given over a user’s device — and how little it can take to abuse that trust. Security researcher Patrick Wardle, founder of the Mac-security outfit Objective-See, found that a low-privileged process running on the same machine as Muse can quietly hijack the assistant’s voice channel, intercept what a user says, and ultimately walk away with account credentials.

An Undocumented Setting Becomes an Open Door

At the center of the flaw is a configuration parameter Meta never documented publicly, referred to in Wardle’s research as endo_voyager_dictation_endpoint. In a properly locked-down system, a setting that controls where an AI assistant sends a user’s spoken audio would only be adjustable by the assistant itself or by an authenticated administrator. Wardle found the opposite: any ordinary, unprivileged process running on the Mac can rewrite that value.

Because the setting isn’t gated behind macOS’s usual permission prompts, malware doesn’t need root access, a kernel exploit, or even a particularly sophisticated delivery method to abuse it. It simply needs to run, once, with the same limited privileges any downloaded app or script would already have.

From a Config Change to a Full Hijack

Once the dictation endpoint is redirected, Muse’s voice traffic no longer goes to Meta’s backend — it goes wherever the attacker points it. Wardle built a proof-of-concept tool, which he named “not-a-mused,” to demonstrate the practical fallout. With the redirect in place, an attacker’s server can:

• Capture everything a user dictates to Muse before it ever reaches Meta’s servers
• Inject fabricated instructions back to the assistant, effectively puppeteering its responses and actions
• Harvest authentication tokens and account credentials tied to the user’s Muse session
• Ride along on whatever permissions Muse has already been granted on the system

That last point is what makes the bug more than a curiosity. Muse, like many emerging AI agents, isn’t confined to a chat window. It has been extended delegated access to files, other applications, email, calendars, web browsing, and in some configurations even purchasing flows. A compromise of the assistant’s input channel is effectively a compromise of every one of those integrations at once.

Why This Matters Beyond One App

Wardle has argued that the underlying problem isn’t unique to Meta. Traditional macOS malware is at least somewhat constrained by the operating system’s privacy controls — permission dialogs for the microphone, camera, contacts, and so on. AI agents complicate that model because they are frequently pre-authorized for a wide swath of those same permissions on the user’s behalf, and because their “instructions” arrive as natural language rather than through a fixed API that can be easily validated. A prompt-injection style attack that would be relatively contained in a narrow app becomes far more consequential when the compromised app can also read a user’s inbox or move files around.

Security teams evaluating AI assistants have generally focused on data the assistant might leak through its own outputs. This case flips that concern: the entry point wasn’t the model’s behavior at all, but a plain configuration value that should never have been writable by another process in the first place.

No Patch Yet, Limited Mitigations

As of publication, Meta has not issued a public patch or detailed timeline for fixing the dictation-endpoint issue, and the company had not substantively responded to the disclosure when the research became public. That leaves Muse users on macOS with few options beyond general hygiene: avoiding untrusted downloads and scripts, monitoring for unexpected network connections from AI-agent processes, and treating any assistant with broad system permissions as a high-value target worth extra scrutiny.

For enterprise security teams, the episode is a useful prompt to inventory exactly which permissions AI agents deployed across the fleet have actually been granted, and whether those grants can be scoped down without breaking the features employees rely on. As agentic AI tools proliferate on both desktop and mobile, flaws like this one are likely to become a recurring category rather than a one-off.