Meta Fixes Zero-Day in Muse 16 Hours After Disclosure
An unprotected config key allowed any local process on a Mac to redirect audio to Meta's agent, inheriting access to Mail, Files, and Messages.
On September 21, security researcher Patrick Wardle published a thread on X and a proof-of-concept repository on GitHub, dubbed not-a-mused, illustrating that any local process running without privileges on a Mac could hijack Muse, Meta's personal AI agent recently launched. Meta distributed a hotfix about 16 hours later. The three commits in the repository are dated September 21, implementing over 50 commands of the agent.
The flaw was not in encryption or input validation. It resided in an undocumented configuration key called endo_voyager_dictation_endpoint, which determines where the application sends user dictation audio. The key was left unprotected. Any local process running with the user's own permissions could rewrite it, redirecting transcription traffic from Meta's servers to an endpoint controlled by the attacker.
The Scope is Permission, Not the Bug
When the user clicks the microphone and dictates a prompt, the audio goes to the attacker's server. This already captures what was said, but the worse consequence comes on the return path: whoever controls the endpoint controls the response, thus injecting prompts into the agent. From there, the attacker inherits everything the user granted to Muse, which on macOS includes access to Files, Mail, Messages, Calendar, and Notes.
Lateral movement changes the calculation for those managing corporate fleets. A compromised Mac allows interaction with other devices belonging to the same user running Muse, including invisibly tasking the iOS client. There was also a remote vector in a ClickFix style: a single command executed by the victim gave the attacker control scoped to Muse over all devices enabled on that account.
An agent with read permission to email and files is not an application; it’s a walking credential with wide scope and no rotation. Threat modeling inherited from endpoint software does not cover this, as it assumes the compromised process has the privileges of the binary. Here the compromised process has the privileges the employee granted in a permission dialog, and no one on the security team saw that dialog.
Sixteen Hours and What They Indicate
Meta's response speed deserves recognition. A business day between public disclosure without prior coordination and distributed correction is above-average performance for a flaw requiring a change in client behavior. It’s also the kind of number only achieved when the fix is swapping a configuration key, not redesigning an authentication flow.
Wardle supports the opposing reading, which is difficult to dismiss: the issue is not the correction time but rather a network endpoint configuration being shipped writable by a process without privilege in a product requesting access to Mail and Files. While the vulnerability remained open, he publicly recommended that no one install Muse.
The Same Agent, Three Jurisdictions
For European companies, dictated audio is considered personal data in transit to an unauthorized destination. If the incident had impacted a corporate fleet in the European Union, Article 33 of the GDPR would trigger the 72-hour countdown to notify the data protection authority, and the fact that the leak occurred through the supplier's configuration does not transfer the obligation of the controller to Meta.
In Brazil, the LGPD and ANPD regulations on incident communication impose an equivalent duty, compounded by the fact that personal AI agents often enter companies through individual installations, outside the IT inventory. Legal departments and law firms that have adopted assistants on Macs for meeting transcription are in the worst possible combination: confidential data, broad permission, unmanaged installation.
In the United States, there is no comprehensive federal incident notification law, and the obligation falls into a mosaic of state laws, each with different deadlines and triggers. A company with offices in California and New York responds to two distinct clocks for the same event.
The takeaway from the 16 hours is about governance, not engineering. None of the device management tools that companies already pay for can enumerate which AI agents are installed in the fleet and what scope each one has been granted. Until this list exists, the response to incidents of this type begins with an inventory that no one has.