• An undocumented Muse preference, endo_voyager_dictation_endpoint, can be rewritten by any unprivileged local process with no password or entitlement check, per Wardle's proof-of-concept repository.
• This is a local-privilege-escalation bug, not remote code execution: the attacker must already be running code as the logged-in user, either through conventional malware or a ClickFix-style trick that gets a user to paste one terminal command.
• Wardle's PoC, not-a-mused, released September 21, 2026, intercepts dictation traffic and captures Muse's authentication material, implementing only a subset of the more than 50 commands the assistant exposes.
• The Hacker News and Cyber Security News both reported that Wardle used a hijacked session to pull a linked iPhone's location and run a Bluetooth Low Energy scan.
• Meta has not published a security advisory; The Hacker News reported Wardle referenced a fix Meta pushed out, but the outlet could not confirm what it actually changes.

Meta's macOS AI assistant, Muse, ships with an undocumented preference — endo_voyager_dictation_endpoint — that any unprivileged process running as the logged-in user can rewrite with no password, entitlement, or permission prompt, according to a proof-of-concept issued by Mac security researcher Patrick Wardle on September 21, 2026. Flipping that setting redirects Muse's voice-dictation traffic to a server the attacker controls, letting them intercept dictated prompts and capture the account's authentication material. The catch, confirmed in Wardle's own repository: an attacker must already be running code as the user before any of this works. Meta has not published a security advisory.

The bug: a setting nothing gates

The flaw is structural. Muse stores its dictation-server address in the endo_voyager_dictation_endpoint preference, and Wardle's proof-of-concept, not-a-mused, shows that value can be changed by any process running as the logged-in user — no elevated privilege required. Once redirected, Muse keeps sending dictation traffic to the attacker's server as if nothing changed, per the repository's own description, opening the door to intercepted prompts, injected instructions, and stolen authentication material.

The precondition the headline can undersell

This is not remote code execution against a clean Mac. Cyber Security News reported the exploit requires an attacker who can "first gain the ability to run code as the local user, perhaps through conventional malware or a social-engineering technique," and Wardle's own repository states an attacker "must already be able to execute code as the local user." The Hacker News reported one such technique: a ClickFix-style lure that tricks a user into pasting a single command — still local code execution, just without a traditional malware payload.

A subset of a 50-command surface

Wardle's proof-of-concept implements only part of what he says Muse exposes. Cyber Security News and the not-a-mused repository both put the assistant's total exposed command set at "more than 50," spanning functions the PoC does not fully demonstrate. That gap matters for scale: a fully weaponized version of the bug could reach further than what Wardle chose to show publicly.

The reported reach: a linked iPhone

Two outlets reported the same device-reach demonstration: The Hacker News said Wardle "used it to direct the Muse app on his own iPhone to report its exact location, run a Bluetooth scan of nearby devices," and Cyber Security News described "separate demonstrations" that showed a compromised account "identifying linked devices and directing an online iPhone to return location information or initiate a Bluetooth Low Energy scan." Neither outlet reported a demonstrated data-exfiltration example beyond that device-location and scan test.

Meta's silence, and an unverified fix

As of publication, Meta has issued no CVE or security bulletin for the flaw. The Hacker News reported that Meta "pushed out what he called a 'fix'" — attributing the characterization to Wardle — but said it "could not confirm what the change does," and separately reported Wardle plans to present related findings at the Objective by the Sea conference in Hawaii in November. Cyber Security News similarly found no public Meta response to Wardle's specific findings as of its reporting.

The verdict

This is a real bug, not a hypothetical: an unauthenticated, locally-writable setting sitting beneath an assistant with reach into linked devices is a bad design choice regardless of the precondition. But the precondition is real too — an attacker needs local code execution first, whether via malware or a ClickFix trick, and that changes the risk calculus from "anyone can be hit remotely" to "anyone already compromised gets hit much harder." Until Meta publishes a verifiable advisory, Mac users running Muse should treat the local-execution bar as low, not zero, and watch for a confirmed patch rather than an unverified social-media claim.