Meta’s Muse AI Assistant Rolled Out With a Serious Security Flaw
Meta shipped Muse on 8 September 2026 with an undocumented setting, endo_voyager_dictation_endpoint, that any process running as the user could rewrite to capture dictated audio and the token controlling the agent. Patrick Wardle published a working proof of concept on 21 September; Meta hotfixed the Mac app a day later. This article sets out the mechanism stage by stage, separates what was demonstrated from what was described, puts Meta’s account beside the researcher’s, and covers the enterprise visibility problem the patch did not address.
