Meta patched a macOS vulnerability in its Muse voice dictation feature that could let an unprivileged process redirect dictation traffic to an attacker-controlled endpoint
Security issue Provisional 87% confidence first seen
A security researcher demonstrated that, on macOS, an unprivileged process could modify an undocumented Muse setting to redirect Muse dictation traffic to an attacker-controlled endpoint. Meta later issued a patch to close the zero-day “dictation traffic hijack” path, confirmed by Sept. 22, 2026, reducing the risk of audio/prompt capture and potential misuse after local compromise.