Security researcher Patrick Wardle, founder of the Objective-See Foundation, has disclosed an unpatched zero-day vulnerability affecting Meta's newly released desktop client for Muse on macOS. While Meta Chief Executive Officer Mark Zuckerberg had claimed that the autonomous artificial intelligence assistant was built from the ground up for privacy and security, the reported flaw enables locally running software or shell commands to hijack the application. Through this vector, unprivileged software can circumvent standard macOS security boundaries by co-opting the extensive permissions previously granted to the assistant by the user. As the company did not release a formal security advisory or coordinate with a CVE Numbering Authority, the vulnerability currently lacks an official CVE designation.
Image Source: Patrick Wardle
The underlying vulnerability stems from an undocumented configuration preference key named endo_voyager_dictation_endpoint. On macOS systems, local processes and arbitrary scripts executing within an unprivileged user context can overwrite this configuration value without requiring elevated administrative rights or triggering operating system authorisation prompts. Under standard operation, this parameter designates the cloud-based server endpoint responsible for receiving voice dictation audio and returning transcriptions. By modifying this setting, an attacker can silently reroute the assistant's outbound dictation traffic to a server under their direct control.
From an exploitation standpoint, the vulnerability compromises both input confidentiality and account credentials. When a user activates dictation, the desktop client dispatches raw microphone audio along with the valid authentication token associated with the victim's Muse account to the configured endpoint. Wardle demonstrated that an attacker can operate a proxy server that captures authentication tokens and audio data while seamlessly forwarding legitimate traffic back to Meta's servers to prevent detection. Armed with valid session credentials and direct control over the command pipeline, an attacker can also conduct prompt injection attacks, appending hidden instructions to voice requests to force the assistant into performing unauthorised background tasks, such as exfiltrating local documents or WhatsApp message histories. The technical significance of the flaw lies in access amplification and the erosion of platform trust boundaries. Operating systems like macOS rely on the Transparency, Consent, and Control framework to restrict application access to hardware peripherals, files, address books, and calendars. Because Muse functions as an agent capable of interacting with applications, calendars, email, and files, users routinely grant it extensive system authorisations. Wardle noted that the exploit allows malicious actors to manipulate the agent rather than developing complex standalone infostealer malware, effectively turning the signed, trusted assistant into an attack surface. A former Meta artificial intelligence security engineering manager echoed these architectural concerns, indicating they would avoid using the software due to the inherent risks of deep integration.
Wardle published a proof-of-concept exploit titled not-a-mused, demonstrating the execution of numerous commands through the compromised agent. The disclosure arrived shortly after Amazon moved to block Muse from its shopping platform, citing non-compliance with automated agent access policies. Following the public disclosure, Meta deployed a hotfix to the macOS Muse application. The fix stripped the internal debugging preference setting from production client builds, thereby preventing local modification of the dictation server destination.
The company treated the flaw as an internal configuration defect rather than following formal CVE assignment procedures. David Singleton of Meta Superintelligence Labs framed the issue as a local configuration problem requiring prior code execution, and the engineering team resolved it by silently stripping the internal debugging preference key from production builds. The community rejects that claim, as can be seen in reactions from security professionals commenting on the given post. They pointed out that initial access is trivialised by social engineering lures like ClickFix, whereas bypassing Apple's Transparency, Consent, and Control framework is traditionally complex. In broader engineering debates on Hacker News and Reddit, observers noted that by packaging device cross-sync, full disk permissions, audio streams, and private chat histories into an un-sandboxed, signed agent with a modifiable debug endpoint, Meta effectively gave commodity malware a zero-effort conduit to bypass platform protections without raising operational alerts