Meta has deployed an emergency hot-fix for its newly released Muse AI assistant for Mac, addressing a critical zero-day vulnerability that could have allowed attackers to completely hijack the agent. The patch, issued on September 22, 2026, arrived less than 24 hours after security researcher Patrick Wardle publicly disclosed the exploit, which he titled “not-a-mused.”
The vulnerability targeted the desktop version of Muse, which Meta had released just days earlier, on September 17. By exploiting an undocumented macOS configuration setting, an attacker could redirect the AI’s communications to a malicious server, granting them access to the user’s private data and connected applications.
The ‘Not-a-Mused’ Exploit Mechanics
The flaw resides in how Muse handles its dictation and communication architecture. Wardle discovered that the application relied on a specific, undocumented macOS setting known as endo_voyager_dictation_endpoint (alternatively referred to as endovoyagerdictation_endpoint). This setting defines the server address where the AI sends voice or text data for processing.
To successfully execute the exploit, an attacker first needs local code execution on the target Mac—meaning the system must already be compromised by malware or accessible via physical contact. Once this foothold is established, a script can be used to modify the dictation endpoint. Wardle published a proof-of-concept script, notamused.py, to demonstrate how easily this redirection could be achieved.
According to Unite.AI, Meta responded to the disclosure at 06:36 UTC on September 22, confirming that the cloud-side hot-fix was active. Because Meta Muse operates largely through a cloud-based Secure VM architecture, the company was able to mitigate the risk without requiring all users to manually download a traditional software update for the Mac client.
Data Theft and Application Hijacking
While the requirement for local access provides a layer of protection, the potential consequences of a successful hijack are severe. Because Muse is designed to act as an integrated personal assistant, it maintains deep permissions within the macOS ecosystem to facilitate its “agentic” features.
By hijacking the dictation endpoint, an attacker can capture the authentication tokens Muse uses to communicate with Meta’s servers. These tokens provide a “key to the kingdom,” allowing the attacker to bypass standard security prompts and gain control over the assistant’s access to other applications. Specifically, the exploit could allow an unauthorized party to:
- Read and send messages via WhatsApp and Messenger.
- Access and modify private calendars.
- Read through personal email archives.
- Exfiltrate any data the user provides to the AI assistant.
This rapid disclosure and subsequent patching highlight the security challenges facing the new wave of “AI agents.” Unlike static chatbots, agents like Muse are granted broad permissions to act on behalf of the user, making any vulnerability in their communication pipeline a high-stakes target for exploitation. Mac users who installed Muse prior to September 22 should ensure their application is running the latest version, though Meta’s server-side fix has effectively closed the primary “not-a-mused” vector for the desktop client.
