Meta Muse Zero-Day: One Hidden Preference Redirects the Agent's Dictation and Hands Over Its Tokens

Meta Muse, Meta's personal AI agent launched in the US in September 2026 with access to files, email, messages, calendar, shopping, and smart-home apps, on macOS

Patrick Wardle disclosed on September 22, 2026 that Muse's Mac app reads an undocumented setting, `endo_voyager_dictation_endpoint`, from its user-writable preferences to decide where voice input is sent. Any process running as the logged-in user can change it without further permissions. Once redirected, the attacker's server receives the audio and transcriptions, can inject instructions that Muse trusts as the user's own, and captures session tokens that allow account takeover across every device linked to that Muse account. Wardle drove a Muse instance on his iPhone to report its location, scan nearby Bluetooth devices, and list available smart-home commands, and showed that a ClickFix-style lure, where a victim pastes a command into Terminal, is enough to deliver the change remotely. Meta shipped a fix announced in a post on X shortly before its Connect event but published no advisory. Separately, Amazon blocked Muse from shopping on Amazon.com about 12 hours before the disclosure, saying Meta had not notified it that Muse would access the site and that the agent does not identify itself while shopping

A security-relevant endpoint stored where unprivileged code can rewrite it, on an agent whose voice channel is treated as the user's authenticated intent and whose tokens unlock every connected service