Muse's Undocumented Endpoint Turns macOS Agent Into a Local Backdoor

On September 21, 2026, security researcher Patrick Wardle disclosed a zero-day vulnerability in Meta’s Muse macOS application. Launched on September 17, 2026, Muse is the first build to feature deep computer-use capabilities, granting the agent broad access to a user’s local files, email, messages, calendar, and notes. The application reached the top of the US App Store within days, accumulating over 2.5 million downloads in its first 13 days. The core issue is that the agent, designed to act on behalf of the user with broad system permissions, has itself become the primary attack surface.

Mechanics of the Vulnerability

The vulnerability centers on an undocumented preference key, endo_voyager_dictation_endpoint . Any unprivileged local process on a macOS system can modify this key to redirect dictation traffic. By manipulating this endpoint, an attacker can hijack the agent’s input stream. Wardle has published a proof-of-concept, titled not-a-mused , on GitHub , which demonstrates the implementation of over 50 Muse commands.

This flaw exposes five distinct attack vectors that demonstrate the risks inherent in granting an agent such deep system integration:

Audio Theft: Unauthorized interception of dictated audio content.

Prompt Injection: Injecting malicious prompts that the Muse agent trusts and executes.

Session Hijacking: Stealing authentication or session tokens to gain invisible control over the agent.

Device Pivoting: Using the compromised Mac as a bridge to attack other Muse-enabled devices, including those running iOS.

Remote ClickFix: Executing social-engineering attacks through the agent’s interface.

No CVE has been assigned as of September 22, 2026, and Meta has not published a formal advisory. However, the company issued a hotfix to the Muse macOS app roughly 12 hours after Wardle’s public disclosure. David Singleton of Meta Superintelligence Labs characterized the issue on X as a local privilege escalation rather than a remote exploit, assessing the practical risk to users as “quite low.”

Implications for Enterprise Security

The Muse vulnerability highlights a new class of risk: the agent-as-attack-surface. When an application is designed to act on behalf of a user with broad system permissions, the agent itself becomes the primary target for exploitation. On September 21, 2026, Amazon blocked Muse from shopping, citing concerns that the agent did not identify itself as an AI and appeared to capture and store customer credentials without notification. Dan Goodin of Ars Technica reported that a former Meta AI security engineering manager stated he would never use the application due to the risks of such deep integration. Furthermore, an Oppenheimer survey indicates that only 8% of US consumers trust Meta with their passwords.

Connection to the September Trust Cluster

This incident is a continuation of the trust architecture failure pattern observed throughout September 2026. The Muse vulnerability aligns with the broader trust infrastructure cluster that has impacted systems including BlueMoon , ADSys , SharePoint , the Linux Kernel , and Cisco ISE . In each of these cases, the failure occurs at the agent interface layer, where the boundary between user intent and machine execution is compromised.

Given the severity of the disclosed attack vectors and the absence of a formal advisory or CVE, enterprise security leaders should ensure the hotfix has been applied to all managed Muse macOS installations and restrict deployment on devices where local code execution is a threat model concern. The current architecture, which relies on per-user dedicated Linux VMs hosted in Meta’s cloud, does not mitigate the local risks posed by the endo_voyager_dictation_endpoint vulnerability. Until Meta publishes a formal advisory and a CVE is assigned, the application should be treated with elevated caution on managed macOS environments.