Malware that already runs as a logged-in user on a Mac can quietly hijack Meta’s new Muse AI assistant and inherit every permission the owner granted the app—reading files, mail, messages, calendars and smart-home controls—according to a proof-of-concept published by veteran macOS security researcher Patrick Wardle on 21 September 2026. The Hacker News reported the findings on 22 September. The attack does not break into a Mac on its own; it requires prior code execution. Once that foothold exists, a single undocumented preference turns Muse’s microphone dictation into an attacker-controlled channel, effectively converting a trusted, signed AI agent into the “ultimate backdoor,” Wardle warned.
Muse is Meta’s personal AI agent, launched this month in the United States. Users can connect it to files, email, messaging, shopping and smart-home apps. That broad access is the point of the product—and the reason the flaw matters. macOS normally sandboxes applications so that one program cannot freely read another’s files, camera, microphone or saved logins. An attacker who steers Muse instead operates with whatever access the user already approved for the assistant, and security software may see only a legitimate Meta-signed process issuing commands.
How the hijack works
Wardle found an undocumented preference key, `endo_voyager_dictation_endpoint`, that decides where Muse sends dictation audio. Any process running as the logged-in user can rewrite that preference and point it at an address the attacker controls—no extra permissions required. After the change, when the user taps the microphone and speaks a prompt, the audio and transcribed text go to a local program the attacker is running instead of Meta’s servers.
From there, Wardle demonstrated three outcomes: reading what the user dictated; injecting extra instructions that Muse trusts and executes; and capturing a session token that authenticates to the user’s Muse account. Because a Muse account can be signed in on multiple devices, that token let him issue commands to Muse on an iPhone from the compromised Mac—requesting precise location, running a Bluetooth scan of nearby devices, and listing available smart-home actions. In his tests, the assistant drafted messages rather than sending them autonomously, but the remote-control path was clear.
Wardle also noted a realistic remote entry path: a ClickFix lure that fools a user into pasting a single Terminal command, delivering the initial foothold without a traditional malware download. He did not report the issue to Meta before full public disclosure, arguing that users needed to understand the risk quickly. Meta has since pushed what Wardle called a “fix” via social media; The Hacker News said it could not independently confirm the change, and Meta had not published a formal security advisory at the time of reporting.
What the attack does not do
The research does not claim a break of Meta’s cloud isolation between user agents, nor a defeat of macOS protections that stop one app from reading another’s keychain items. Muse itself transmits its token with the redirected dictation; the attacker abuses access the assistant already holds. The finding is therefore less a remote zero-click exploit than a stark illustration of how powerful AI agents expand the blast radius of ordinary malware once they sit on the desktop with broad entitlements.
For consumers and enterprises evaluating AI assistants, the lesson is operational as much as technical. Every additional connector—mail, calendar, home automation—becomes part of the compromise surface if an attacker can influence the agent. Undocumented endpoints and custom dictation pipelines that bypass Apple’s on-device speech systems create trust boundaries that traditional endpoint products do not yet model well.
What Mac users and admins should do now
- Quit or uninstall Muse until Meta publishes a clear security advisory describing the fix and verifying that the dictation endpoint can no longer be redirected by unprivileged code.
- Review and revoke Muse permissions for files, mail, messages, calendar and smart-home integrations you do not need.
- Avoid Muse voice dictation on any Mac that might already be compromised; the demonstrated path depends on spoken prompts.
- Never paste Terminal commands from websites, emails or chat messages—ClickFix is how a remote attacker obtains the required foothold.
- If Muse ran on a suspect Mac, treat the Muse account and connected services as exposed: change passwords from a clean device, revoke sessions, and audit smart-home and messaging activity.
- Enterprise IT: inventory Muse installations, block the app via MDM until vendor guidance is confirmed, and add detection for unexpected writes to Muse preference files.
Evidence status
- Confirmed: Wardle released a working proof-of-concept showing dictation redirection, instruction injection and token theft against Meta Muse on macOS; The Hacker News independently summarised the research on 22 September 2026.
- Reported: Meta appeared to ship a rapid change that Wardle described as a fix; no detailed CVE-style advisory was available at publication time.
- Unconfirmed: Scale of real-world abuse, whether other AI assistants share analogous preference-hijack patterns (Wardle said he has found related issues under responsible disclosure), and the completeness of Meta’s remediation.
In brief
- A hidden Muse preference lets malware already on a Mac redirect voice dictation, inject instructions and steal account tokens.
- Compromised Muse access can extend to other devices signed into the same account, including iPhones.
- Until Meta confirms a durable fix, users should remove or tightly constrain Muse and treat ClickFix-style Terminal lures as high risk.