Researcher's 'not-a-mused' PoC showed Meta Muse's macOS app could be hijacked via an undocumented dictation-endpoint setting

Meta (Muse macOS users)·Meta Muse (macOS app)Fixed

Security researcher Patrick Wardle found that any unprivileged local process could modify an undocumented Muse setting (endo_voyager_dictation_endpoint) to redirect the app's dictation traffic to an attacker-controlled server, enabling prompt injection, capture of dictated audio, and theft of Muse authentication material.

Blast radius

Demonstrated via proof-of-concept only; no confirmed in-the-wild exploitation disclosed, but the flaw could expose any data or connected account the user had granted Muse access to, since Muse holds broad access to files, camera, location, calendar and linked iPhones.

Root cause

Muse treated a locally mutable configuration value as part of a trusted instruction/audio channel, so unprivileged local code could redirect it without elevated permissions.

How it was caught

Independent security researcher (Patrick Wardle, Objective-See) found and publicly disclosed the flaw with a working exploit.

What changed

Meta shipped a hotfix (users were told to update to Muse v2.1) removing the exploitable setting from production builds.

Take-awayAny configuration value an agent consults at runtime is part of its trust boundary — local, unprivileged processes should never be able to silently redirect an agent's instruction or audio channel.