On September 21, 2026, macOS security researcher Patrick Wardle publicly disclosed a serious zero-day vulnerability in the Mac version of Meta's AI assistant Muse: any locally running program could rewrite one of Muse's undocumented settings, redirecting dictation transcription traffic to an attacker-controlled server and stealing the user's account authentication token. In the early hours of September 22, David Singleton of Meta Superintelligence Labs announced an emergency hotfix.
The attack chain: how a debug setting became a backdoor
The exploitation path is startlingly direct:
- Muse's dictation feature doesn't transcribe on-device; it sends audio to Meta's cloud servers.
- The shipping build kept an internal, debug-only setting that can rewrite the dictation transcription endpoint. The problem: the setting lives in local preferences, which any program running under the same user account can modify — no privilege escalation needed.
- An attacker points the transcription endpoint at their own server, and the user's dictated audio flows to them.
- Worse, the requests also carry Muse's account authentication token — with it, an attacker can fully take over the victim's Muse account.
Wardle also demonstrated proof-of-concept attacks that used Muse's already-granted system permissions to write files and snap photos via the camera, with the user barely noticing. In his words, attackers don't need to write a full Mac malware suite anymore — they can "just borrow the AI assistant itself."
Why this is worse than an ordinary app bug
The crux is Muse's privileges. Launched on September 8, Muse is a do-everything personal agent — sending email, booking travel, shopping, tracking goals — so it requests system permissions for files, microphone, camera, location, and calendars, and plugs into WhatsApp, email, and social accounts. The more privileged the agent, the larger the blast radius of a single flaw — and Wardle's demo proved exactly that: what gets compromised isn't one feature, but the entire bundle of trust the user handed to the assistant.
In the same week, Amazon had just begun blocking Muse's automated shopping feature (see our coverage). Platform walls and a security hole arriving together put Muse's "high-privilege assistant" approach under a double interrogation.
Meta's response — and the unanswered questions
Singleton's statement stressed Meta's commitment to transparency around Muse's privacy and security, explaining the setting as an internal switch kept for debugging and development. Two questions remain: first, why an internal debug switch shipped in a production build at all; second, as of September 22, no CVE number has been assigned and public technical details remain limited.
Q: What should Mac users do right now? A: Update Muse to the latest version — the patch is out. Also audit the permissions you've granted Muse and trim them to "just enough."
Q: Can this be exploited remotely? A: No. It doesn't provide remote access on its own; an attacker first needs local code execution via malware or social engineering. But once they have it, the impact is account-wide.
