Meta Muse AI Assistant’s Zero-Day Vulnerability Could Enable Attackers to Inject Malware

According to Archyde, macOS security researcher Patrick Wardle disclosed the vulnerability on September 21, 2026[2]. Tech Insider reports that Wardle published a proof-of-concept tool called not-a-mused on GitHub[3].InfoQ reports that the flaw comes from an undocumented configuration preference key named endo_voyager_dictation_endpoint[4]. CPO Magazine says that an attacker could point this setting to an attacker-controlled domain, intercept Muse dictation, and access the AI assistant's authentication token[1].Malwarebytes says that this is not a remote-code-execution vulnerability that can compromise an otherwise clean Mac[5], because the attacker first needs a way to run code locally[5]. Cyber Security News reports that Wardle calls the defect "access amplification", because ordinary malware could target Muse and exploit the broader authority already granted to the agent[6].According to Rejoicehub, Meta's David Singleton described the issue as a local privilege increase, rather than a remote attack[7]. CPO Magazine reports that Meta has released security hotfixes for the zero-day vulnerability by removing the dictation setting in production builds[1].CPO Magazine also reports that Amazon blocked Muse after the zero-day vulnerability was made public, claiming it violated the company's Conditions of Use[1].Alan Snyder, CEO of NowSecure, told CPO Magazine that "Meta moved quickly to patch this zero-day, but security teams should pay close attention to the access Muse had"[1].According to Archyde, Wardle plans to deliver a full technical breakdown of the exploit vector at the upcoming Objective by the Sea conference in November[2].