The Agent as an Attack Surface
On September 21, 2026, security researcher Patrick Wardle disclosed an unpatched 0-day vulnerability in Meta’s Muse macOS application. Launched on September 17, 2026, Muse is the first build to feature deep computer-use capabilities, granting the agent broad access to a user’s local files, email, messages, calendar, and notes. The application reached the top of the US App Store within days, accumulating over 2.5 million downloads in its first 13 days. The core issue is that the agent, designed to act on behalf of the user with broad system permissions, has itself become the primary attack surface.
Mechanics of the Vulnerability
The vulnerability centers on an undocumented preference key, endo_voyager_dictation_endpoint. Any unprivileged local process on a macOS system can modify this key to redirect dictation traffic. By manipulating this endpoint, an attacker can hijack the agent’s input stream. Wardle has published a proof-of-concept, titled not-a-mused, on GitHub, which demonstrates the implementation of over 50 Muse commands.
This flaw exposes five distinct attack vectors that demonstrate the risks inherent in granting an agent such deep system integration:
- Audio Theft: Unauthorized interception of dictated audio content.
- Prompt Injection: Injecting malicious prompts that the Muse agent trusts and executes.
- Session Hijacking: Stealing authentication or session tokens to gain invisible control over the agent.
- Device Pivoting: Using the compromised Mac as a bridge to attack other Muse-enabled devices, including those running iOS.
- Remote ClickFix: Executing social-engineering attacks through the agent’s interface.
As of September 22, 2026, there is no CVE assigned, no official Meta advisory, and no patch available to remediate the issue.
Implications for Enterprise Security
The Muse vulnerability highlights a new class of risk: the agent-as-attack-surface. When an application is designed to act on behalf of a user with broad system permissions, the agent itself becomes the primary target for exploitation. On September 20, 2026, Amazon blocked Muse from shopping, citing concerns that the agent did not identify itself as an AI and appeared to capture and store customer credentials without notification. Dan Goodin of Ars Technica reported that a former Meta AI security engineering manager stated he would never use the application due to the risks of such deep integration. Furthermore, an Oppenheimer survey indicates that only 8% of US consumers trust Meta with their passwords.
Connection to the September Trust Cluster
This incident is a continuation of the trust architecture failure pattern observed throughout September 2026. The Muse vulnerability aligns with the broader trust infrastructure cluster that has impacted systems including BlueMoon, ADSys, SharePoint, the Linux Kernel, and Cisco ISE. In each of these cases, the failure occurs at the agent interface layer, where the boundary between user intent and machine execution is compromised.
Recommendations
Given the lack of a patch and the severity of the disclosed attack vectors, the most prudent course of action for enterprise security leaders is to restrict the deployment of Muse on managed devices. The current architecture, which relies on per-user dedicated Linux VMs hosted in Meta’s cloud, does not mitigate the local risks posed by the endo_voyager_dictation_endpoint vulnerability. Until Meta provides a formal advisory and a verified patch, the application should be treated as an unmanaged risk to the local macOS environment.