Researcher finds a Muse token-exposure path via a macOS debug setting; Meta patched by Sept. 22

Security researcher Patrick Wardle says Meta has already patched a zero-day in Muse, the company’s newly launched personal AI agent, after he disclosed it on September 21, 2026. The issue was ugly in a very specific way: a local process with no special privileges could change an undocumented setting and quietly send Muse’s dictation traffic somewhere else.

Wardle posted his findings on X, then followed them with a proof of concept on GitHub called “not-a-mused.” The repository’s history shows the work landing on September 21: the title and description were added, the script was created, and the README was updated. By the next morning, he was back on X saying, essentially, that the patch had landed and he was happy about how quickly it happened.

The flaw sits in a setting called endo_voyager_dictation_endpoint. When a user taps Muse’s microphone button and speaks a prompt, the app can be tricked into sending that dictation to an attacker-controlled endpoint instead. Wardle said the consequences could include stolen audio, prompt injection, theft of Muse authentication material, and abuse of whatever access the user had already granted the agent. His own summary was blunt: Muse’s access can become the attacker’s access.

That matters because Muse is not just another local app with a small blast radius. Wardle said the proof of concept only needs code execution as the local user, but Muse may have far broader access than ordinary malware would get on its own. He also said a successful hijack could extend to connected devices running Muse, including the mobile iOS client, and later noted that a remote ClickFix-style path existed too, requiring only a single user-run command.

Meta had launched Muse on September 8, 2026 with a security design meant to assume the agent could be under attack. The company said its daemon and tools run inside a systemd-nspawn runtime cell, with Sentinel acting as the permission gate for connector actions and network egress. It also said it would pay up to $300,000 through its bug bounty program, and up to $130,000 for successful prompt-injection reports affecting one user. Wardle’s disclosure is a neat reminder that even systems built around guardrails can still trip over one badly placed switch.