Meta Muse on macOS: Malware Steals AI Assistant Credentials

A preference key any process can rewrite

On 21 September 2026 Patrick Wardle published a proof-of-concept against Meta Muse for macOS. The target is an undocumented preference key, endo_voyager_dictation_endpoint, which decides where the app sends dictation.

Any program running as the logged-in user can point it at an address the attacker controls, with zero additional permissions and zero consent prompts. The technical detail comes from The Hacker News report of 22 September 2026^[1].

Muse is the personal agent Meta launched in the United States this month. Once active, it works across files, email, messages, calendar, purchases and connected-home apps. Its reach depends on the permissions the owner grants it.

An official CVE identifier is still missing. This newsroom logs it as a design weakness disclosed by a researcher, with a patch yet to be documented, and as the first public case of an endpoint infostealer targeting the credentials of an AI assistant.

The path from audio to a hostile server

The mechanism is straightforward. The user taps the microphone and dictates a prompt. The audio and the transcript reach a small program the attacker is running on the same machine, instead of Meta's servers.

From there the PoC demonstrates three distinct capabilities: reading the dictated content, injecting instructions that Muse treats as legitimate, and capturing the token that authenticates the account.

The injection is the heavy part. The attacker's text enters the flow as the user's own words, so the agent treats it as an authorised command and acts accordingly. A single added instruction is enough to make the assistant perform an action its owner knows nothing about.

This is prompt injection in its purest form. The trusted input channel becomes a third-party-controlled channel, and the model has no means of telling the two origins apart.

The token that works on every device

Capturing the token moves the incident from local to distributed. A Muse account can stay signed in on multiple devices, so whoever holds the token commands the assistant wherever it is active.

Wardle used the token from his own Mac to drive Muse on his iPhone. The app reported his exact location, ran a Bluetooth scan of nearby devices and listed the available smart-home commands.

The perimeter changes character. The malware runs on an endpoint; the effect lands on a phone and inside a connected home.

Whoever obtains those credentials also acquires the conversation history, meaning weeks of personal and corporate context. The same attack chain is described by tech-insider.org^[2], which classifies it as a backdoor enabled by a hidden setting.

Why security telemetry stays blind

Detection products miss this attack for a structural reason. The commands originate from Muse, a signed and legitimate application, rather than from a suspicious binary.

macOS isolates apps from one another. The TCC subsystem prevents one process from reading another's files, microphone, camera or credentials, so ordinary malware stays confined inside a tight fence.

An agent with broad permissions breaks that fence on the attacker's behalf. Whoever drives Muse obtains everything the user granted the app, and every action appears in the logs signed by a trusted application.

The practical result is unambiguous: rules based on process reputation produce zero alerts. The attack surface is the trust the operating system extends to a signed app holding assistant-grade permissions.

The root condition: concentrated privilege by design

This newsroom has been repeating one thesis for months. The security posture of AI systems runs two or three years behind infrastructure maturity, and the Muse case confirms it on new ground: the personal endpoint.

The root condition is simple. An agentic assistant installed on the machine is a privilege escalation by design, because it concentrates into a single process the permissions the operating system had carefully kept apart.

A user-writable preference key decides where the audio ends up. That is a security boundary entrusted to a configuration file, an architectural choice that moves control outside the protected perimeter.

Every agent that accumulates authorisations reproduces the same pattern. The system an agent can reach is the system an agent compromises.

The honest counter-argument on severity

The weakness requires one precise condition: code execution as the logged-in user. Muse therefore falls outside the category of initial-access bugs, and the researcher says so openly.

This lowers the formal severity and raises the practical one. Modern infostealers obtain user-level execution routinely, and the route flagged here is ClickFix: the victim pastes a single command, with zero files downloaded and zero installations.

The balance point sits right here. Once that level of access is reached, the value of the haul changes by an order of magnitude: session cookies and passwords before, now control of an agent with permissions over email, calendar and home devices.

Wardle advises against installing Muse and describes the operation as "trivial to turn Muse into the ultimate backdoor". The position is blunt and remains consistent with what the PoC demonstrates.

Three questions for enterprise AI teams

Moving from research curiosity to procurement decision requires three concrete checks. They apply to every agentic assistant installed on corporate machines, including personal ones under BYOD.

1. Which processes can rewrite the agent's preferences on disk, and under what integrity control?
2. Is the assistant's session token revocable server-side, per individual device, within an hour?
3. Which agent actions require explicit human confirmation, and which run autonomously?

Each one yields a binary outcome. When the answer is missing, the assistant remains a component without governance, and its presence across the fleet becomes a risk accepted by implication.

I would add a fourth criterion for the vendor: where does the trust boundary between local preferences and remote endpoints run? A vague answer is worth exactly as much as no answer.

Decisions for the next planning cycle

For the CTO the priority is inventory: which agents run on managed endpoints, with which TCC permissions, with which revocation mechanism. Agent identity is the control plane of 2026.

For the Head of Engineering there is a single operating rule. Treat an assistant's voice and text input as hostile data, with independent validation before any action that produces effects.

The CFO is assessing a new risk. An assistant with access to the connected home and to the management team's calendar shifts exposure from the IT sphere to the physical security of executives.

The procurement committee has material to renegotiate. Every contract covering endpoint agentic assistants should mandate server-side token rotation and revocation, per-device named logging, and complete documentation of the configuration keys that influence network endpoints.

The final check is simple: a written commitment on patch timelines. Meta has yet to publish an identifier and a fix, and that fact weighs more than any product sheet.