Meta Muse macOS zero-day

Meta's Muse AI assistant for macOS contains an unpatched zero-day vulnerability, disclosed by security researcher Patrick Wardle, that lets any local unprivileged process overwrite an undocumented setting controlling where the agent sends voice dictation data and authentication tokens. Wardle named the flaw 'not-a-mused'; it hides in a setting called endo_voyager_dictation_endpoint. Exploiting it requires the victim to be using voice dictation with Muse integrated into apps such as email, WhatsApp, or calendar, at which point an attacker can piggyback on voice commands to escalate privileges and access connected apps and their content. No patch, fixed version, or security advisory from Meta had been confirmed as of September 22, 2026. Wardle attributes the flaw partly to Meta's decision to process dictation in the cloud rather than locally on-device, and said Apple's local-dictation approach would have prevented this class of exploit. Wardle's stated recommendation was to not install Muse.

Separately, Amazon blocked Muse from its platform, citing lack of permission, the agent's failure to identify itself while browsing, and credential security concerns. Meta maintains Muse runs in a secure virtual machine and requests user approval before sensitive actions. Shopify CEO Tobi Lütke responded to the Amazon block by announcing a Muse partnership integrating Shop Pay across Shopify's store network. Analysts suggest Meta could end up paying Amazon for access in a business-to-agent toll arrangement. The divergence between Amazon and Shopify reflects a structural difference: retailers like Amazon depend on controlling advertising and add-on purchases tied to human eyeballs, while e-commerce enablers like Shopify earn from software licensing and services. Mark Zuckerberg also revealed Muse Charm, a roughly 2-inch holdable device with an OLED touchscreen, 5G, front and rear cameras, speakers, microphones, and a USB-C port. It runs a new operating system built around Muse and acts as a one-touch physical endpoint for the agent's cloud-based architecture. A small number of units exist; hardware details are still being finalized ahead of a December 2026 target launch with no pricing announced.