Meta has shipped a hotfix for the macOS Muse desktop client, removing a hidden preference that any local program could freely rewrite. The issue was disclosed on September 21 by Patrick Wardle, founder of the Objective-See Foundation and a macOS security researcher, who also released a proof-of-concept tool on GitHub called "not-a-mused." David Singleton of Meta Superintelligence Labs confirmed the fix has shipped.
An undocumented setting
The setting at fault is a preference called endo_voyager_dictation_endpoint, which determines which server Muse sends voice dictation data to. According to Wardle's disclosure, the setting appears in no documentation, and any program running with the current user's privileges — or a single terminal command — can change it, with no administrator password required.
Once changed, whatever a user says to Muse is routed to an attacker's server first. Exploitation paths compiled by several security outlets include eavesdropping on voice content, intercepting authentication tokens, and injecting prompts into the backend model through a legitimate session — from there reading data or acting on the user's behalf through apps Muse already has access to, such as email, calendar, and WhatsApp. Other reports say Wardle demonstrated remotely obtaining the location of a linked iPhone from a compromised Mac, via the same Muse account.
Wardle's comment on social media was blunt:
"Please don't install. It's trivial to turn Muse into the ultimate backdoor."
How Meta is framing it
Singleton described it as a local configuration issue that requires an attacker to already be executing code on the machine. That framing has a technical basis: the flaw can't be triggered remotely over the network — an attacker first needs the victim to run a piece of code. Meta also did not request a CVE number for it, treating it internally as a configuration defect, and fixed it by stripping the debug-only preference out of the production build.
The security community's pushback centers on how low that bar actually is. Social-engineering tactics like ClickFix have become common over the past couple of years, tricking users into pasting a single command into a terminal — which is all it takes to complete the "run code locally" step. When Zuckerberg launched Muse, he said it was "built from the ground up for privacy and security." An agent client with no sandboxing, whose server address can be rewritten on a whim, falls well short of that promise.
Several days passed between disclosure and the fix. iTnews' report on September 22 noted it had received no response from Meta yet, and another security outlet reported the flaw as still unpatched a day after disclosure. Throughout that window, Wardle's proof-of-concept code remained publicly available on GitHub for anyone to reproduce.
Meta has not disclosed the specific version numbers covered by the fix, nor whether the flaw saw real-world exploitation during the disclosure window. Wardle says there are additional issues he plans to reveal in November at the Objective by the Sea conference.
Who's affected
The direct risk falls on users who already have Muse installed on a Mac and have granted it permissions like microphone, files, and email access. What these users need to do is simple: confirm the client has updated, and avoid running terminal commands from unknown sources.
The problem is thornier for enterprise IT. A desktop AI agent needs system-level permissions to get anything done, and once macOS's TCC permissions are granted, any program that can impersonate that client's identity can potentially piggyback on the same access. Muse was previously blocked from Amazon's shopping platform for violating its automated-agent access policy. After this incident, administrators approving employee requests to install desktop agents will likely add "can local processes tamper with its configuration" to their checklist.
Sources: InfoQ, iTnews, CocoLoop, The Register, ITHome; verified the vulnerable setting's name, the public availability of the proof-of-concept tool, and how Meta handled the hotfix.