One Setting, Total Takeover
Security researcher Patrick Wardle has published a proof-of-concept showing that malware already running on a Mac — with nothing more than ordinary user-level access — can silently hijack Meta's Muse AI assistant and inherit every permission its owner granted it. The technique doesn't require an exploit or privilege escalation of any kind; it abuses a hidden, undocumented configuration setting stored in Muse's own preferences.
The endo_voyager_dictation_endpoint Setting
The vulnerable parameter, named endo_voyager_dictation_endpoint, controls where Muse sends audio captured for dictation. Because it's stored in a preferences file any process running as the logged-in user can modify — no elevated permissions required — malware can quietly repoint it to an attacker-controlled server. From that point on, everything a user speaks to Muse is mirrored to the attacker in real time.
What Attackers Gain
Once the dictation endpoint is redirected, Wardle demonstrated an attacker can:
- Capture spoken prompts and their transcribed text as the user dictates to Muse
- Inject instructions that Muse trusts and executes, since the assistant has no way to distinguish a redirected stream from a legitimate one
- Steal authentication tokens to hijack the user's Muse account outright
- Control the assistant remotely across every device it's connected to
- Inherit every permission the user has granted Muse — file access, email, and any connected smart-home systems
The attack requires malware already present on the machine; it's a post-compromise escalation path, not an initial-access vector. But that's precisely what makes it dangerous — it turns a modest foothold into control over an assistant that many users have quietly handed broad, standing access to their digital life.
Response and Affected Platforms
Affected: Muse's macOS application is where the hidden setting lives, but because a hijacked account token also works cross-device, an attacker can extend control to any iOS device signed into the same Muse account.
Meta's response: Meta reportedly shipped a fix following Wardle's September 21, 2026 disclosure, though the company has not published a formal security advisory, and no CVE identifier has been assigned.
Recommendations
- Update the Muse app on macOS and iOS to the latest available version.
- Treat AI assistants with broad permissions as high-value targets — audit what Muse (and similar assistants) can actually access, and revoke anything beyond what's actually needed.
- Standard endpoint hygiene still matters most here — since this requires a prior foothold, keeping malware off the machine in the first place (EDR, cautious downloads, patched software) closes the door before this technique becomes relevant.
- Security teams evaluating AI assistants for enterprise deployment should ask vendors directly how sensitive configuration — like where audio or text streams are sent — is protected from modification by any process running as the user.