Meta Muse macOS AI assistant: undocumented dictation-endpoint setting lets any unprivileged process turn it into a backdoor and capture the account token ('not-a-mused')

Patrick Wardle (Objective-See) disclosed on 2026-09-21 a zero-day in Meta's Muse macOS AI assistant: any locally running unprivileged process can flip the undocumented endo_voyager_dictation_endpoint preference, redirecting the user's dictated audio/prompts to an attacker-controlled server that also receives the Muse account's authentication token. With the token, an attacker controls the Muse account and every connected service (WhatsApp, email, calendar, camera, location, linked iPhones). Meta shipped a hotfix within roughly a day and classified practical risk low (requires code already running locally); Wardle countered that ClickFix-style social engineering suffices. No CVE assigned.

Consumer/enterprise AI assistants hold broad delegated permissions to the user's digital life. This shows a single undocumented config key lets non-privileged local code silently exfiltrate the assistant's auth token and turn the trusted AI assistant into a persistent backdoor - an agent-identity theft pattern where the 'assistant' becomes the attacker's tool.

Local unprivileged process (or user-executed ClickFix command) sets the undocumented endo_voyager_dictation_endpoint preference to an attacker server; dictation/audio/prompt traffic and the Muse auth token flow to that server.

Meta Muse AI assistant for macOS (hotfixed ~2026-09-22; no CVE/version published)

Apply Meta's Muse hotfix; use the latest Muse build; treat untrusted local processes/commands as a threat; review ChatGPT/assistant linked-account grants.