Meta has issued a hotfix for a flaw in the Mac version of Muse that allowed an unprivileged local process to redirect the AI agent’s dictation traffic, capture authentication material and use the access a person had already granted to Muse.
Security researcher Patrick Wardle disclosed the vulnerability on September 21 with a public proof of concept called not-a-mused. Meta confirmed to Ars Technica that it pushed a hotfix roughly 12 hours after the report appeared. The company has not published a CVE, a security advisory with affected version numbers or evidence that the flaw was exploited outside the researcher’s tests.
The bug matters because Muse is designed to work across email, calendars, messaging, files, payments and connected devices. It did not give an attacker initial access to a Mac by itself. Instead, it let code already running as the signed-in user turn Muse into an access amplifier, potentially reaching data and actions that ordinary local malware could not use as easily.
How the Muse takeover worked
Wardle found an undocumented Muse preference named endo_voyager_dictation_endpoint. Any process running in the user’s session could change that setting without special macOS privileges. Muse then trusted the replacement address as the service that should receive voice dictation.
An attacker could point the setting at a server under their control and wait for the user to press Muse’s microphone button. The malicious server could sit between the app and Meta’s real transcription service, read dictated prompts, alter them before forwarding them and receive the authentication token sent with the connection.
The published code shows that this was more than a theoretical endpoint swap. It can capture the token, inspect Muse sessions and chat history, and submit supported actions through the agent. The proof of concept includes examples such as writing a file, displaying a notification and requesting a photo when Muse already has the required camera permission.
That distinction is central to the risk. The vulnerability did not magically bypass every macOS permission prompt. It inherited the permissions and connected-service access the user had intentionally given Muse. An agent authorized to use sensitive apps becomes a valuable target because compromising the agent may be easier than rebuilding all of those integrations in conventional malware.
Why a local flaw still had a remote attack path
Meta characterized the issue as requiring local code execution, according to Ars Technica. That is technically accurate: an attacker needed a process or command to run in the victim’s user session before changing the Muse preference.
Wardle also demonstrated how a remote attacker could satisfy that requirement with a ClickFix lure. These attacks show a fake error, verification step or security warning and instruct the person to paste a command into Terminal. The user runs the command, giving the attacker the local foothold needed to rewrite Muse’s endpoint. No administrator password was required for the demonstrated preference change.
ClickFix is not a speculative delivery method. Government and security teams have documented campaigns that use fake browser repairs and copy-and-paste instructions to install malware. In the Muse scenario, a single command could prepare the redirection; the next dictated prompt would trigger the token exposure.
The Mac flaw could also reach beyond the Mac. The Hacker News reported that Wardle used the stolen access to read chat history and control Muse on another signed-in device, including retrieving an iPhone’s location and scanning for nearby Bluetooth devices. The weakness was in the Mac client, but the credential it exposed belonged to a cloud account that could span devices.
The flaw bypassed the part of Muse Meta emphasized least
At launch, Meta focused on the isolation of the cloud environment where Muse works. Its announcement described a dedicated Muse Secure VM, credential storage that hides passwords from the agent and a separate Sentinel system that reviews outbound actions. It also promised approval prompts for sensitive actions and an audit trail.
Wardle’s finding did not break the Secure VM’s isolation. It attacked the client-side route into that environment. By altering where dictated input went and capturing the account token attached to the connection, the proof of concept reached the trusted agent through a boundary outside the protections Meta had highlighted.
That architecture is a broader warning for personal agents. Securing a browser sandbox, remote virtual machine or model runtime is only part of the job. Desktop preferences, deep links, local IPC services, update channels, authentication tokens and voice pipelines all become control surfaces when the app on one side has extensive authority on the other.
What Muse users should do now
Meta says the flaw has been hot-fixed, so the first step is to make sure the Muse Mac app has received the update before using voice input again. Because Meta has not published an affected-version table, users cannot compare a clearly documented fixed build against the version on their Mac. Quit and reopen Muse, install any offered update and check Meta’s support channels for a fixed-version notice.
- Do not paste commands into Terminal from a website, message or unsolicited support prompt. A legitimate browser check does not need a shell command to prove that a person is human or repair page content.
- Review Muse’s connected services and permissions. Remove access to email, calendars, files, photos, location, camera or other services that the agent no longer needs.
- Check Muse activity and chat history for actions you did not request. Meta promotes an audit trail as a core control; unexpected sessions, file actions, messages or device activity deserve investigation.
- If you ran a suspicious command or saw unexplained Muse behavior, disconnect linked services and sign out of other Muse sessions. Reconnect accounts only after the Mac has been checked for persistence or other malware.
- Organizations should inventory Muse installations. Endpoint teams can look for the app, unexpected changes to its preferences and shell activity associated with paste-and-run lures, then verify that managed Macs have received the fixed client.
Users should not assume the hotfix removes malware that may already be on a Mac or invalidates every token that could have been captured. Meta has not publicly described its token-revocation process for this incident. Anyone with a credible sign of compromise should treat the problem as an endpoint and account incident, not only an application update.
What Meta still needs to document
The rapid hotfix closes the disclosed route, but the public response leaves operational gaps. Meta has not identified affected Muse versions, named the fixed version, assigned a CVE, explained whether relevant tokens were rotated or described telemetry that could reveal attempted exploitation.
Those details are especially important for an agent that can maintain long-running goals and work across accounts. Customers need a reliable way to prove that the vulnerable client is gone, determine whether a token left the device and understand which connected services remain exposed after an account takeover.
The incident also gives agent developers a concrete design checklist: lock down mutable service endpoints, scope tokens to devices and narrow actions, keep high-value credentials out of ordinary client traffic, validate local requests, use on-device processing where practical and log security-sensitive configuration changes. A secure cloud workspace cannot compensate for a desktop client that lets any user-level process redirect the road into it.
