Meta's Muse AI Agent Has a Zero-Day That Lets Malware Hijack Its Microphone

Zero-day flaw: Security researcher Patrick Wardle disclosed a Muse AI agent vulnerability with a proof-of-concept named "not-a-mused."

Attack vector: An unprivileged local process can modify the endo_voyager_dictation_endpoint setting to redirect dictation traffic.

Potential impact: Attackers could capture dictated prompts, perform prompt injection, and steal Muse authentication material.

Patrick Wardle, founder of the Objective-See Foundation and a macOS security researcher, has published a zero-day vulnerability affecting Meta's Muse AI agent. The bug lets malware already running under a user's account hijack Muse's microphone input and feed it malicious instructions.

Wardle’s proof-of-concept (POC) exploit, called "not-a-mused," is available on GitHub.

How the Muse Dictation Redirect Works

The zero-day vulnerability centers on an undocumented setting called endo_voyager_dictation_endpoint . Wardle's research shows that an unprivileged local process – no elevated permissions required – can modify this value, rerouting Muse's dictation traffic away from its intended server and toward one controlled by the attacker.

Once redirected, an attacker can:

Intercept dictated audio and prompts before they reach Muse's backend,

Inject prompts into Muse,

Steal authentication material tied to the victim's account,

Abuse access the user has granted Muse.

That combination opens the door to prompt injection and session hijacking through what should be a trusted AI workflow.

Why This Counts as Access Amplification

Wardle is clear that the vulnerability doesn't grant remote code execution ( RCE ) on an untouched machine – an attacker still needs to already be running code as the local user.

But he frames it as "privilege/access amplification" – malware that would otherwise be boxed in by the machine’s privacy controls could instead ride on Muse's broader delegated permissions across connected services, turning a limited local foothold into something more.

Meta's Security Setup and Bounty Program

Meta markets Muse as security-first , built around a dedicated Secure VM, protected credential storage, and user-controlled permissions.

The company runs a public bug bounty for Muse, offering up to $300,000 for qualifying security flaws and rewarding impactful prompt injection reports separately.

Earlier this month, CPR tested crafted prompts against four LLM gatekeepers and detailed PuzzleMask, a plain-prose attack that bypasses AI gatekeepers.