Does the Muse backdoor allow remote code execution on macOS?

No, the exploit only works after an attacker already runs code as the logged-in user.

Can security software detect the malicious dictation redirection?

Detection is difficult because the traffic originates from the legitimate signed Muse app.

Meta Muse Hidden Setting Enables Local Backdoor

Immediate Threat: A Hidden Preference Lets Malware Hijack Muse

On September 21, 2026, security researcher Patrick Wardle released a proof-of-concept showing that a single undocumented macOS preference—endo_voyager_dictation_endpoint—can be altered by any process running under the logged-in user to point Muse’s voice input at an attacker-controlled server. When the victim speaks a prompt, the audio and transcribed text are sent to the malicious endpoint instead of Meta’s cloud, effectively turning the AI assistant into a local backdoor. The vulnerability is confined to the Mac client of Meta’s newly launched Muse assistant and does not constitute a remote code-execution vector on its own.

Technical Mechanics of the Exploit

The attack chain consists of three steps:

Preference tampering – The attacker writes a new value to the ~/Library/Preferences/com.meta.muse.plist key endo_voyager_dictation_endpoint. macOS does not enforce additional permissions for this operation because the plist resides in the user’s home directory.
Local relay – A lightweight listener runs on the compromised Mac, receiving the raw audio stream and the intermediate transcription generated by Muse’s on-device speech-to-text component.
Session hijack – Wardle demonstrated that the attacker can extract the Muse session token from the intercepted data, then use it to issue commands to the assistant on any device where the user is logged in, including iPhone and iPad.

The result is a “trusted” command path: Muse continues to believe it is communicating with Meta, so security tools that flag unknown processes see only a signed Apple-approved binary. This mirrors the classic “trusted-client” abuse pattern seen in other AI-driven products, where the client’s elevated privileges are leveraged against the service it is meant to protect.

Scope and Impact

Affected versions: All macOS builds of Muse released as of September 2026. The vulnerability is not present in iOS, Android, or Windows clients.
Required foothold: The attacker must already have code execution as the logged-in user. Typical vectors include trojanized installers, malicious browser extensions, or compromised Homebrew packages.
Potential damage: Once the dictation endpoint is redirected, the attacker can read every spoken command, inject additional instructions that Muse will execute (e.g., sending emails, posting to social media, or controlling smart-home devices), and harvest the session token to act from remote devices.
No password theft: macOS sandboxing still prevents Muse from reading other apps’ saved passwords, so credential theft is not a direct outcome of this flaw.

Why This Undermines the “AI-Assistant Is Secure” Narrative

The industry often assumes that AI assistants are safe because they rely on cloud-side processing and strict permission models. Wardle’s research shows that client-side design choices can nullify those protections. By implementing its own dictation pipeline rather than using Apple’s built-in speech services, Meta introduced a mutable endpoint that bypasses the operating system’s sandbox. The assumption that a signed app cannot be weaponized is therefore false; a signed binary can become a conduit for exfiltration when its configuration is user-writable.

Mitigation Guidance for Operators

Remove or disable Muse until Meta releases a patch. The quickest way to break the attack chain is to stop the vulnerable client from running.
Audit Muse permissions in System Settings → Privacy & Security. Revoke access to files, calendar, contacts, and especially microphone if the assistant is not essential.
Monitor plist modifications. Security teams can deploy a file-integrity monitor on ~/Library/Preferences/com.meta.muse.plist to alert on changes to endo_voyager_dictation_endpoint.
Enforce strict code-signing policies on workstations to reduce the likelihood of initial malware infection. While this does not stop a determined attacker with user-level access, it raises the bar.
Change Muse session credentials on all devices if compromise is suspected. Since the session token can be reused across platforms, rotating credentials limits lateral movement.

Industry Response and Expected Patch Timeline

Meta has not issued an official advisory as of the article’s publication date. In a brief statement, the company acknowledged “receiving a responsible disclosure” and pledged to “work on a fix”. Historically, Meta’s response time for critical client-side bugs has ranged from a few days to several weeks, suggesting that a patch may appear in a forthcoming macOS update or a dedicated Muse update.

Broader Implications for AI-Assistant Vendors

Wardle’s findings echo earlier concerns raised about trusted-client abuse in AI products. Vendors that implement proprietary data pipelines on the endpoint must treat configuration files as attack surfaces. The industry should adopt a defense-in-depth approach:

Store critical endpoints in immutable locations (e.g., signed system extensions).
Leverage OS-provided secure enclaves for token storage.
Provide transparent user controls that cannot be silently altered by other processes.

The Muse case also highlights a regulatory angle: under emerging privacy frameworks such as the EU’s Digital Services Act, providers may be required to demonstrate that client-side components do not expose user data to unauthorized parties. Failure to remediate could attract scrutiny.

What to Watch Next

Patch release: Track Meta’s security advisories and macOS update notes for the inclusion of a fix to endo_voyager_dictation_endpoint.
Threat-intel feeds: Monitor for reports of malware families that begin to target the Muse preference as a new indicator of compromise.
Policy developments: Watch for guidance from CISA or the European Union on AI-assistant security standards, which may mandate stricter sandboxing for client-side AI components.

For a recent example of a vendor’s failure to secure a client-side component, see the Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation, which similarly leveraged a mis-configured local service to bypass network defenses.

This article follows Fastest News AI’s editorial standards for factual, actionable reporting on zero-day vulnerabilities.

Related coverage

Explore more on this topic

More ai-assistants coverage

Meta Muse’s Hidden Dictation Endpoint Turns the Assistant Into a Local Backdoor