Meta’s Muse sends dictation to a third-party server: an unprivileged app can spoof the address

Wardle researches macOS internals professionally; his PoC is called not-a-mused. From one Mac, he reached the device inventory API, with more than 50 available commands, and the phone’s owner saw nothing.

Muse is Meta’s personal agent. On Mac, it requests access to five apps: Files, Mail, Messages, Calendar, Notes. The flaw grants that access to any program that has already landed on the machine.

On 08.09.2026, Muse launched in the US on phones, in the browser, and within WhatsApp. On 17.09, a Mac version arrived and requested access to files, mail, and messages. Four days later, a public PoC appeared.

What is broken. The macOS Muse client contains an undocumented setting, endo_voyager_dictation_endpoint, for the dictation server address. A normal process can overwrite it without special privileges. Audio, prompts, and authentication material are sent to an attacker’s server, while the agent receives someone else’s instructions in return.

It is not a one-click takeover. Code must first be run on the Mac; Muse does not open the door by itself. Wardle calls the flaw a privilege escalation: malware gains “far broader access than it would otherwise have.” Social engineering can induce that execution: the ClickFix scheme asks victims to paste a line into Terminal, supplied by a website posing as a CAPTCHA.

Permissions are removed in Settings. The user enables Muse’s access to the computer, while Full Disk Access is optional. Access to each of the five apps can be granted and revoked in Settings at any time. The app is free, downloaded from Meta’s website, and the free tier includes 100 million tokens per week.

Apple has a ready-made on-device dictation API. Meta built its own backend, and Wardle links that to data access.

Muse’s bug bounty pays up to $300 000 for a vulnerability and up to $130 000 for prompt injection.