# A zero-day has been released for Meta's Muse

> Source: <https://github.com/pwardle/not-a-mused>
> Published: 2026-09-22 01:45:55+00:00

A proof-of-concept for a local Muse ([https://muse.ai](https://muse.ai)) vulnerability 0day that can let an unprivileged local process redirect Muse’s dictation traffic and abuse the trust/access granted to the app.

Muse exposes an undocumented setting:

`endo_voyager_dictation_endpoint`

A local attacker or malware can modify this endpoint without special privileges.

Once redirected, dictated prompts can be sent to an attacker-controlled endpoint, potentially allowing:

- Capture of dictated audio/prompts
- Prompt injection into Muse
- Theft of Muse authentication material
- Abuse of whatever access the user has granted Muse

In short: Muse’s access can potentially become the attacker’s access.

Run:

```
./not-a-mused -h
```

for available options.

The PoC implements a subset of the 50+ commands exposed by Muse.

Once running, click the microphone button in Muse and dictate a prompt to trigger the PoC.

This is a **local attack**. An attacker must already be able to execute code as the local user.

The concern is that Muse may have significantly broader access than ordinary local malware, making it a particularly useful target for privilege/access amplification.

Provided for security research and educational purposes.