# Muse Mac PoC Exposes a Local Hijack Path

> A public proof of concept redirects Meta's Muse dictation channel and captures credentials, but the attack first requires code execution as the logged-in Mac user.

_Source: Researcher proof of concept, first-party product page, and social-media report; no public Meta remediation notice found · 2026-09-22 · 6 min read_

Canonical: https://iyu.app/e/meta-muse-mac-local-hijack-poc

## The 60-second version

A public PoC redirects Muse for Mac's dictation endpoint through a local proxy that can observe prompts and capture authentication material.

**Key points**

- The attacker must already execute code as the logged-in Mac user; this is not a demonstrated zero-click remote compromise.
- The risk is amplification because Muse is intended to access communication, calendars, commerce and a persistent cloud browser.
- The repository is technical evidence, while the former Meta employee's quoted opinion is context rather than proof.
- No public Meta advisory was found confirming affected versions, patch status or exploitation in the wild.

**Verdict.** Pause dictation and reduce permissions until Meta publishes verifiable remediation details; if local malware is suspected, investigate the Mac rather than only uninstalling Muse.

## Full explainer

> **⚑ Caveat:** A public PoC and its source code support the reported local attack path, but iyu did not independently reproduce it. We found no public Meta advisory confirming affected versions, exploitation in the wild, or remediation status.


### The finding — What the proof of concept changes

Security researcher Patrick Wardle published [not-a-mused](https://github.com/pwardle/not-a-mused), a macOS proof of concept that changes an undocumented Muse preference named `endo_voyager_dictation_endpoint`. The code redirects Muse's dictation connection to a local WebSocket proxy and restarts the app.

When the user next dictates a prompt, the proxy sits between Muse and Meta's legitimate upstream service. The repository says this can expose transcripts and an `ABRA` authentication token, creating paths to prompt capture, prompt injection, credential theft, and use of capabilities already trusted by the account.

- **1 local foothold** — required before the PoC can alter Muse's preference
- **50+ commands** — the researcher says Muse advertises; the PoC implements a subset
- **0 public advisories found** — confirming affected versions or a Meta fix at publication time


### Risk boundary — Serious amplification, not remote magic

The attack is local. Code must already be running as the logged-in Mac user. The PoC does not show an internet attacker compromising a clean Mac merely by knowing that Muse is installed.

The security concern is **amplification**. Ordinary local malware may have limited reach, while an agent is deliberately trusted with accounts, data and actions. If malware can borrow the agent's session or input channel, it may inherit part of that trust.

- **What is demonstrated:** A local-user process can rewrite the dictation endpoint, proxy traffic and attempt to capture Muse authentication material.
- **What is not demonstrated:** A zero-click remote infection, exploitation at scale, or compromise of every Muse user.
- **Why the impact may grow:** Muse is designed to act across communication, commerce, calendars and a persistent cloud browser environment.
- **What remains unknown:** Affected versions, server-side mitigations, patch availability and observed abuse in the wild.


### Evidence — Separate the code from the commentary

The widely shared [International Cyber Digest post](https://x.com/IntCyberDigest/status/2102108849893158963) accurately links to Wardle's repository and summarizes the local redirection claim. It also cites a recently departed Meta AI security manager saying he would not personally use the product because of security and privacy concerns.

That opinion is not proof of the exploit. The attached screenshot redacts the speaker's identity and supplies no affected-version or remediation details. The repository and its code are the technical evidence; Meta's [official Muse page](https://muse.ai/) establishes the product's intended access and capabilities.


### Response — What users and security teams should do

- **Pause Mac dictation** until Meta documents whether the current build is affected and how it is fixed.
- **Update Muse and macOS**, then review Files, Mail, Messages, Calendar, Notes, camera and accessibility permissions; remove anything not required.
- **Treat suspected local malware as the primary incident.** Investigate login items and recent installs, and rotate relevant credentials from a clean device.
- **For enterprise pilots**, test whether agent endpoints and preferences are user-writable, inventory tokens, and map every command the agent can invoke.

> An AI agent becomes a high-value target because its usefulness is built from accumulated trust.

The operational conclusion is simple: this PoC does not eliminate the need for an initial Mac compromise, but it shows why that foothold can become more valuable when a broadly connected agent is present. Wait for a concrete Meta advisory before treating the issue as fixed.


## Primary sources

- [International Cyber Digest report on X](https://x.com/IntCyberDigest/status/2102108849893158963)
- [Patrick Wardle - not-a-mused proof of concept](https://github.com/pwardle/not-a-mused)
- [Muse official product page](https://muse.ai/)

---
_Published by iyu (https://iyu.app) — the day's AI news, checked against primary sources and rewritten in plain language. Free to quote with attribution and a link to the canonical URL._