Meta Hot-Fixes Muse Zero-Day That Let Attackers Hijack the AI Agent

Security researcher Patrick Wardle said on September 22, 2026 that Meta had hot-fixed a zero-day vulnerability in Muse, its newly launched personal AI agent, following his public disclosure on September 21, 2026 that an unprivileged local process could redirect the Mac app’s dictation traffic to an attacker-controlled endpoint and invisibly hijack the agent.

Public Disclosure and Patch Confirmation

Wardle published his findings in an X thread that began at 14:42 UTC on September 21, 2026, warning users not to install Muse and writing that serious zero-day flaws could let local malware or attackers invisibly hijack the agent. He paired the thread with a proof-of-concept repository on GitHub titled “not-a-mused”; the repository’s commit history shows its three commits — adding the project title and description, creating the notamused.py script, and updating the README — all dated September 21, 2026.

In a post on his X profile timestamped 06:36 UTC on September 22, 2026, Wardle wrote “Hooray, hot-fixed!” and praised the speed of the patch. In a later post that day, he wrote that he is a fan of full disclosure, saying it gets bugs fixed faster. In his disclosure thread, he had said he would share more details, and more bugs, at the Objective by the Sea v9 security conference.

The Dictation-Endpoint Flaw

According to the proof-of-concept’s documentation, Muse exposes an undocumented setting called endovoyagerdictation_endpoint that a local attacker or malware can modify without special privileges. When a user clicks Muse’s microphone button and dictates a prompt, Wardle’s thread states, the app sends the dictation to the attacker’s endpoint instead. The README lists the potential consequences: capture of dictated audio and prompts, prompt injection into Muse, theft of Muse authentication material, and abuse of whatever access the user has granted the agent. The repository documentation summarizes the impact in one line: “Muse’s access can potentially become the attacker’s access.”

The proof-of-concept implements a subset of the more than 50 commands Muse exposes and is triggered through the microphone-button dictation flow, according to the README. The README notes that the attack is local: an attacker must already be able to execute code as the local user. It frames the risk as one of amplification, stating that Muse may have significantly broader access than ordinary local malware, which makes it a particularly useful target for privilege and access amplification.

In his thread, Wardle listed the practical impact of a successful hijack: stealing a user’s dictated audio, injecting prompts that Muse trusts and executes, and stealing the user’s authentication token to control Muse directly and invisibly. Anything the user had granted Muse access to, including messages, emails, and finances, would also be exposed to the local attacker, he wrote. In a separate post on September 21, he called the flaw trivial to exploit and asked for a fix.

Connected Devices and a Remote Vector

The exposure Wardle described extends beyond a single Mac. In a post at 20:30 UTC on September 21, 2026, he wrote that once a Mac is exploited, an attacker can interact with any of the user’s connected devices that are also running Muse, including remotely tasking the mobile iOS Muse client invisibly.

Wardle wrote on September 22, 2026 that a remote vector had existed as well: a ClickFix-style attack requiring only a single user-run command could deliver the hijack and give a remote attacker Muse-scoped control over all of a victim’s Muse-enabled devices, including iOS. He raised the point both in the post confirming the patch and in a follow-up reply in his disclosure thread.

Meta’s Documented Security Design

Meta launched Muse on September 8, 2026, introducing it as the company’s personal agent in a research blog post detailing the system’s security architecture. Meta said it designed the system to assume the agent may be under attack and to limit the potential damage. Under that design, the agent’s daemon and the tools it executes run inside a systemd-nspawn runtime cell isolated from the host system, and a separate host-side agent called Sentinel acts as the sole permission authority for connector actions and for all network egress. Credentials for connected services are stored in the user’s virtual machine, and Sentinel performs just-in-time credential insertion at the network boundary, so the agent never sees real tokens, according to the post.

In the same post, Meta said it was opening the Muse bug bounty program to anyone, with awards of up to $300,000 for valid reports, including up to $130,000 for successful prompt-injection attempts that affect one user.

Meta’s Help Center documents additional protections: each Muse user’s virtual machine is isolated from other users’ agents, credentials such as usernames and passwords are kept in a Secure Credentials Store that lets Muse complete authorized actions without the AI model seeing the password, and Muse is designed to ask for confirmation before certain important actions, such as sending an email or making a purchase. The Help Center states that important permission and security checks operate separately from the AI model, so they do not depend on the model recognizing a malicious instruction on its own.

Meta’s research post states that Muse is not immune to attack and that prompt injection remains an open problem across the industry. The company said it plans to deliver a Muse Confidential VM, designed to cryptographically and verifiably prevent Meta itself from accessing data in a user’s VM, later this year.