Breaking

Researcher Discloses Local Meta Muse macOS Flaw That Could Hijack the AI Agent

September 22, 2026 at 02:36 EDT

Security
AI Agents

A macOS security researcher has disclosed a local zero-day in Meta's Muse assistant that could let malware already running on a Mac redirect dictated prompts, steal Muse authentication material and abuse the permissions the user granted to the agent. The proof of concept, called not-a-mused, centers on an undocumented setting named endo_voyager_dictation_endpoint that can be changed by an unprivileged local process.

Sep. 21, 2026 - Meta Muse

A local flaw turns trust into reach

An undocumented Muse dictation setting can be changed by local code, redirecting prompts and potentially exposing the agent session that already holds user-granted permissions.

undocumented dictation endpoint

50+

Muse commands in the exposed surface

$300K

maximum public bug bounty award

Paid usage tiers, drawn to scale

$20

Power

$100

Maximum

One stacked block represents $20 per month.

Attack path described by the proof of concept

Local code

Runs as the Mac user

Endpoint switch

Dictation route changes

Session abuse

Agent permissions become reachable

Why users want it

Muse can take on errands such as shopping, email drafts, travel booking and form filling, making everyday delegation feel practical.

Why defenders worry

The same usefulness depends on access to files, accounts, purchases and devices, so a local foothold can become a much larger agent compromise.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.