Meta Muse for macOS (Meta's personal AI agent, launched 2026-09-17): an undocumented preference, endo_voyager_dictation_endpoint, let any unprivileged local process redirect the agent's dictation traffic to a server it chose — capturing spoken prompts, injecting prompts the agent trusts, and stealing the agent's session token, which carries every permission the user had granted Muse (linked-phone location, device actions); Patrick Wardle published the PoC 88 hours after launch (2026-09-21), Meta hot-fixed within a day by removing the setting

View raw markdownEdit on GitHub ↗

TL;DR

Meta shipped Muse, its personal AI agent, as a macOS app on 2026-09-17. On 2026-09-21 Patrick Wardle (Objective-See) published a proof of concept showing that the app read its dictation backend URL from an undocumented preference, endo_voyager_dictation_endpoint, that any process running as the user could change — no root, no TCC prompt, no entitlement. Point it at your own server and you receive the user's dictated audio and prompts, can return prompts the agent executes as the user's own, and capture the authentication material Muse sends with the request — a token that lets the attacker drive the agent and reach whatever the user had connected to it (VentureBeat cites linked-iPhone location and Bluetooth scans). The prerequisite is code execution as the local user, which is why Meta's David Singleton called it "a local privilege escalation attack, not a remote exploit" with "quite low" practical risk; Meta hot-fixed within about a day by removing the setting from production builds, and no exploitation has been reported. The reason this file exists anyway: a personal agent turns ordinary user-level malware — an infostealer, a trojanised extension, a malicious npm postinstall — into something that holds the agent's identity and permissions, and the fix was a configuration change, not a redesign of where an agent keeps its trust anchors.

What happened

  • Launch and disclosure. Meta announced the Muse macOS app on 2026-09-17; Wardle's thread and the not-a-mused proof-of-concept repository went public at 14:42 UTC on 09-21 — "about 88 hours" later (The Register). Muse is Meta's consumer agent (voice, dictation, device actions, linked phone); a sibling product, Muse Code, is a coding agent, and Meta's Muse Spark models are the ones in this repo's eval-containment file — a different incident.
  • The bug. The app's dictation path read its upstream endpoint from a preference key, endo_voyager_dictation_endpoint, that was not documented, not protected and writable by any unprivileged process in the user's session. An attacker-controlled endpoint receives what the app sends there: the dictated audio/prompt stream and the request's authentication material. Because the app treats the response as the transcribed prompt, the endpoint can also inject prompts that Muse acts on as if the user had spoken them.
  • What the token buys. VentureBeat's summary: "the authentication token let attackers control the agent and access linked device information, including geographic locations and device functions"; The Register: "whatever permissions the user previously granted to Muse." That is the point of a personal agent — it is a credential with reach.
  • Meta's response. Statement via David Singleton (Meta Superintelligence Labs), as quoted by The Register: "This was a local privilege escalation attack, not a remote exploit … the practical risk to users of the Muse Mac app was therefore quite low. Nonetheless, we have issued a hotfix to the app to address the issue." VentureBeat: Meta "hot-fixed the Mac app within a day by removing the setting from production builds." No CVE, no Meta advisory page, no version number for the fixed build in any source this sweep read; the app auto-updates.
  • Wardle's position. Malwarebytes quotes his recommendation — "Please don't install" — and his framing that "AI agents need a higher security standard than ordinary apps."

Why "local" is not reassuring here. Every initial-access story in this repo's npm, PyPI and extension files ends with code running as the developer's user. That is exactly the prerequisite. An infostealer that would once have taken browser cookies and an SSH key now also takes the agent — and an agent, unlike a cookie, can act, dictate, and reach the user's linked devices. Enterprise visibility makes it worse: VentureBeat notes Meta's documentation has "no mention of SIEM audit exports, IT admin consoles, or DLP integration," so a hijacked agent's actions would not show up anywhere a security team looks.

Am I affected?

  • You installed Muse for macOS between 2026-09-17 and the 09-22 hotfix and did not restart the app since. Current builds no longer honour the preference.
  • The same shape applies to any agent app that keeps its backend URL, model endpoint or MCP server list in a user-writable config (defaults, a JSON in ~/Library/Application Support, ~/.config, ~/.claude, ~/.cursor) — which is most of them; see the Claude Code ANTHROPIC_BASE_URL exfiltration for the coding-agent twin.
# Muse: confirm the app is current and the preference is absent / inert
defaults domains | tr "," "\n" | grep -i muse | xargs -I{} sh -c 'defaults read {} 2>/dev/null | grep -i dictation_endpoint'
# Generalise: which agent configs on this machine point at a non-vendor host?
grep -rhoE 'https?://[^"'"'"' ]+' ~/.claude ~/.codex ~/.cursor ~/.config/*mcp* 2>/dev/null | sort -u

If you are affected

  1. Update Muse (or let it auto-update), quit and relaunch, and sign out and back in so any session token captured during the window is invalidated — the sources do not say whether Meta rotated tokens server-side.
  2. If you have any reason to think user-level malware ran on the Mac in that window (the actual prerequisite), treat the agent's grants as compromised: review and revoke Muse's connected devices and services, then follow if-your-local-ai-agent-was-exploited.md for the machine itself.
  3. For teams: there is no audit export to check; ask users directly whether Muse performed actions they did not request.

Prevention

  • Treat agent trust anchors — backend URLs, model endpoints, MCP server lists, API keys — as secrets, not preferences: keychain-backed, integrity-checked, or at minimum not writable by every process in the session. prevention/agent-sandboxing.md, prevention/credential-hygiene.md.
  • Pin the agent's upstream: an app that will talk to whatever host a config says is an app whose config is the attack surface.
  • Before installing a personal agent on a work machine, ask what its token can reach and whether any of it is logged anywhere you can see; the answer here was "linked devices" and "no."
  • Keep the developer-machine baseline that makes the prerequisite expensive: no agent installs on the same account that runs untrusted npm installs and unvetted extensions — prevention/supply-chain-attack-surface.md.

Why this matters for vibe coders

Muse itself is a consumer product, but the mechanism is the one every agent on your laptop shares: a config file decides where the agent sends your prompts and its credentials, and that file is writable by the same user that runs your package installs. This repo already has the coding-agent version of this bug (Claude Code's ANTHROPIC_BASE_URL in a repo-local .env); Muse is the personal-agent version, with a session token that reaches your phone. When the next stealer's harvest list includes "AI-agent config files" — as the one in this week's npm compromise does — this is what it is looking for.

Update — 2026-10-06: Apple says it will tighten macOS Full Disk Access controls because AI agents are using the permission "in ways that could put users at risk," naming Muse's iMessage access and this zero-day among the triggers; no date for the change (THN 10-05, SecurityWeek 10-06)

The Hacker News reported on 2026-10-05 (SecurityWeek the next morning) that Apple has announced tighter controls around Full Disk Access (FDA) to restrict how AI agents and other applications reach user data, saying developers are "using Full Disk Access in ways that could put users at risk, exposing everything on their systems — including files, mail, messages, and even browsing history," and that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." THN lists the incidents behind it: Meta Muse reading a journalist's private iMessages after being granted FDA (Meta then clarified its two-permission model), Patrick Wardle's zero-day in this file, and a ChatGPT-for-Mac issue THN identifies as CVE-2026-100754 that could have exposed chat logs — that last id is recorded here from THN only and was not verified against NVD this sweep. Apple gave no timeline: "it's currently not known when the new controls will be rolled out."

For this file: status stays patched (Meta's hotfix removed the preference), and the platform response is the structural one this advisory's Prevention section asked for — an agent that holds FDA holds everything, and until Apple ships the change the only control is not granting it. For readers running coding agents on macOS, note that FDA is also what many developer tools request to read ~/Library and mail archives; the same prompt that Muse used is the one your IDE's agent may show.

Update 2026-11-04 — Meta's Muse bounty post (2026-11-02): a 300,000-dollar pre-launch auth bypass through a proxy-added header, a 90,000-dollar prompt injection that imitated the browsing tool's own status messages, and a one-time-passcode redaction bypass; all fixed, no dates

Meta's "Securing Muse: More Than $1 Million in Bug Bounties Paid Out" (muse.ai, 2026-11-02, David Singleton) says the program ran privately from April and publicly from the launch, which the post dates 2026-09-08 (this file dates the macOS app announcement 2026-09-17), received more than 630 reports, paid 64 of them about 1.2 million dollars, and pays up to 300,000 dollars per report, with prompt injection against one user capped at 130,000. The five findings it describes, in Meta's own framing: (1) 300,000 dollars, about four months before launch: an authentication check in pre-release VMs trusted a header that a local HTTPS proxy added, a migration added a second proxy layer, and outside requests could carry the header; the service was shut down and fixed, and Meta "removed all trust in the local machine". (2) 90,000 dollars: a web page mimicked the browsing tool's status messages and got the agent to take actions it should have blocked; Meta added prompt-injection detection signals and changed how Muse handles suspicious tool output. It says its classifiers now flag the original and 100 variations. (3) 90,000 dollars: certain formatting let one-time passcodes past the email redaction filters, "one part of an end-to-end attack". (4) 50,000 dollars: the Android app's privileged web view loaded a shared-page path from a link without validating the host, so a malicious app could obtain the web view's credentials. (5) 1,000 dollars: a local attacker could abuse the Mac app's auto-update to run code with the app's privileges. No finding carries a date, a CVE or a researcher name. SecurityWeek (2026-11-04, Eduard Kovacs) reports the post and adds nothing. The dictation-endpoint zero-day in this file is not among the five, and the post does not say whether it was paid. Finding (2) is the attack class the Claude Code InversePrompt file describes from the agent side: tool output that looks like the tool's own control messages. Meta's fix is a classifier, not a channel separation, so the status stays patched for the dictation bug and the update is informational.

Sources