A Debug Setting Let Local Code Steal Meta’s Muse

Patrick Wardle showed on September 21, 2026 that any local Mac process could steal Meta’s Muse agent by flipping a hidden dictation setting. Wardle, founder of the Objective-See Foundation, published working exploit code the same day. Meta Superintelligence Labs issued a hotfix on September 22.

The hole never touched the cloud computer Meta spent launch week describing. It lived in the Mac app’s local preferences, where macOS lets any program running as the user make a change. Once Muse is hijacked, the attacker rides the files, camera, accounts, and linked phones the user already handed the agent.

Anyone Could Flip Muse’s Hidden Dictation Setting

Muse on the Mac exposes an undocumented preference named endo_voyager_dictation_endpoint. Wardle’s write-up says a local attacker or malware can change that endpoint with no special macOS permissions. The next time the user clicks the microphone and dictates a prompt, Muse sends the audio to the attacker’s server instead of Meta’s.

David Singleton of Meta Superintelligence Labs later said dictation is powered by a server-side speech model, and that the app shipped with an internal setting that could point that model at a different URL. He said the switch was useful during debugging and development, and that it lived in the app’s local preferences. On macOS, any program under the same user account can edit those preferences.

Wardle’s README puts the result in one line: Muse’s access can potentially become the attacker’s access. The trigger is ordinary use of the product, not a hidden developer menu.

WHAT THE REDIRECT ENABLED

• Stolen audio: Dictated prompts can be captured on an attacker-controlled endpoint.
• Prompt injection: The attacker can feed Muse instructions the agent trusts and then executes.
• Stolen login material: Muse authentication tokens can be taken from the redirected traffic.
• Borrowed access: Whatever the user already granted Muse, from files to camera to linked accounts, can be abused in the agent’s name.

Singleton said overriding the setting would let an attacker proxy audio dictation requests and capture the access tokens the Muse app uses to drive the agent, expanding malware already on the computer into Muse itself.

Meta’s Secure VM Was Not on This Path

On September 8, 2026, Meta introduced Muse in the United States on iOS, Android, and the web, and billed it as a personal agent built from the ground up to be safe, secure, and private. The company put each user’s agent in a dedicated cloud computer with its own browser, then parked a second process on that machine to police what the agent could send to the internet.

Tarek Sheasha, a vice president at Meta Superintelligence Labs, wrote that the system was designed to assume the agent may be under attack. The harness runs in an isolated cell, it does not see real credentials, and every interaction with the outside world runs through Sentinel, which the agent cannot override. Launch copy also said Muse has no visibility into passwords or payment methods, and that people approve sensitive steps such as sending mail or making a purchase.

Singleton’s account of this bug draws a hard line around that architecture. He said the issue does not involve Muse’s servers or the Secure VM that isolates agent tasks. The Mac client was carrying a leftover debug control in ordinary user preferences. Cloud isolation, Sentinel, and token surrogation sit on the other side of a laptop setting any local process could rewrite.

LAUNCH CONTROLS VERSUS THIS BUG

That split is the part of the launch story this bug actually tests. Meta spent its engineering write-up on the cloud box. The first public hijack landed on the Mac client that talks to that box.

50 Commands and a Microphone Click

Wardle named the project not-a-mused and told people not to install the app, writing that it is trivial to turn Muse into the ultimate backdoor. His proof-of-concept called not-a-mused implements a subset of the 50+ commands Muse exposes. After the tool is running, the user clicks Muse’s microphone and dictates a prompt. That is the trigger.

Please don't install – it's trivial to turn Muse into the ultimate backdoor 💀👀

Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life.

But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it.

Let me show you. 🧵 https://t.co/2R7hc9JzyR

— Patrick Wardle (@patrickwardle) September 21, 2026

The demos were not abstract. Wardle used the hijack to take pictures and write malicious files to disk, and in many cases Muse did not warn the user. He also used a stolen Muse account to pull the location of a linked iPhone. The point of those tests is not that Muse is a rootkit on a clean Mac. It is that a trusted agent with broad access is a ready-made toolkit once someone else is holding the token.

We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.

Patrick Wardle, founder of the Objective-See Foundation

He added that Meta should be thinking about security from the very start, and that they are just not. That is a design argument, not a dispute about whether the patch shipped.

What Happens After a Mac Agent Is Stolen?

Wardle’s follow-up on September 21 showed the blast radius crossing devices. Once a Mac is exploited, he wrote, you can interact with any of the user’s connected devices that also run Muse, and remotely task their mobile iOS Muse client. A local foothold on one computer becomes a way to drive the phone’s agent without standing in front of the phone.

Meta and Wardle agree on the first hop. This is a local attack. An attacker must already be able to run code as the user. Singleton called it a local privilege escalation, not a remote exploit, and said using it to do harm therefore requires malicious code already running on the machine under the user’s account.

The practical argument is how that first hop usually arrives. Wardle said after the hotfix that a simple ClickFix attack could deliver the hijack, giving a remote attacker complete access to every victim device running Muse. ClickFix is a social-engineering trick that gets a user to paste a command into Terminal. It is not a hole in Muse’s servers. It is a common way local code gets onto a Mac, and it turns Singleton’s local-only line into a one-step story for anyone who can fool a user into pasting.

Wardle also noted that Apple already offers on-device dictation to developers. If Meta had used that API, this particular redirect would not exist. Muse instead sends voice to its own servers to be processed. That choice is why a leftover endpoint setting could siphon prompts and tokens in the first place.

Hours After Disclosure, a Production Hotfix

Wardle posted the disclosure thread at 14:42 UTC on September 21. Singleton posted the company’s reply at 04:07 UTC on September 22, thanking the report and saying Meta had issued a hotfix to the Muse Mac app. Wardle wrote “Hooray, hot-fixed!” and credited the speed of the patch, then immediately flagged the ClickFix path.

We appreciate this report and have issued a hotfix to the Muse Mac app. This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk… https://t.co/N6gSlWeU3C

— David Singleton (@dps) September 22, 2026

This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low. Nonetheless, we have issued a hotfix to the app to address the issue.

David Singleton, Meta Superintelligence Labs, on X

The fix is specific. Singleton said the hotfix removes the endpoint setting from production builds entirely, which closes this vulnerability. He also pointed researchers at Meta’s bug bounty, which pays up to $300,000 for valid reports, including up to $130,000 for a successful prompt-injection attack that affects one user. Wardle went public with exploit code instead of that queue. Meta still patched.

THE WEEK MUSE GOT HIJACKED

1. September 8, 2026: Meta launches Muse in the US as a personal AI agent on iOS, Android, and the web, with Secure VM and Sentinel as the security pitch.
2. September 20, 2026: Amazon starts blocking Muse from shopping, showing a popup that continued access by an unauthorized AI agent violates its Conditions of Use.
3. September 21, 2026: Wardle publishes the dictation-endpoint hijack and working exploit code, and shows a stolen Mac agent tasking a linked iOS Muse client.
4. September 22, 2026: Singleton says Meta has issued a hotfix that removes the debug endpoint from production builds.

Mac users who installed Muse need that hotfix build. The debug switch is gone from production. The rest of the agent’s granted access is not.

The Agent Still Holds the Keys Users Gave It

Amazon’s block landed the day before Wardle’s thread, and it was about a different kind of trust. An Amazon spokesperson said third-party apps that offer to make purchases on behalf of customers should operate openly and respect a service provider’s decision about whether to participate. Amazon said it was not told Muse would access its store, that the agent does not identify itself when it browses, and that it appears to capture and store customer credentials. Meta’s launch post had said Muse has no visibility into passwords or payment methods. Those two descriptions of the same product sat side by side for a weekend, then the Mac client was hijacked in public.

The commercial week still looked like a win. Estimated downloads of the Muse mobile app in its first 12 days outpaced ChatGPT’s own 12-day debut in the US and Canada, and Meta stock climbed 11 percent on Monday, September 21, 2026. The Mac exploit is a smaller surface than that mobile launch. It is also the surface that turned a leftover debug preference into a way to drive the agent.

Singleton is right that this was not a remote break of a clean machine, and the hotfix that strips the setting from production builds closes the exact door Wardle walked through. The harder remainder is the product Meta wanted: an assistant with files, camera, mail, calendars, shopping, and phones already wired in. Local malware that can speak in that assistant’s voice does not need its own stealer. It needs the agent people already agreed to trust.