Security researcher Patrick Wardle disclosed a hidden macOS preference in Meta’s Muse app that can be altered to redirect dictation to an attacker‑controlled endpoint, creating a backdoor for any program running as the logged‑in user.
What the hidden preference does
The setting, stored under the name endo_voyager_dictation_endpoint, is undocumented in Meta’s public documentation. According to The Hacker News, it "decides where Muse sends dictation" and "any program running as the logged‑in user can point it at an address the attacker controls, without needing extra permissions".
“The setting he found is undocumented and decides where Muse sends dictation. It is stored in the Mac app's preferences under the name endo_voyager_dictation_endpoint, and any program running as the logged-in user can point it at an address the attacker controls, without needing extra permissions.” – The Hacker News
How the proof‑of‑concept works
Wardle’s proof‑of‑concept, released on 21 September 2026, modifies the hidden preference so that when a user taps the microphone in Muse, the spoken prompt is sent to a malicious process on the same Mac instead of Meta’s servers. The vulnerability only activates if the attacker can already execute code as the logged‑in user; it cannot break into a locked Mac on its own.
Attacker capabilities demonstrated
Wardle showed three distinct actions an attacker can perform after changing the preference:
- Read the audio and transcribed text of what the user dictated.
- Inject additional instructions that Muse trusts and executes.
- Capture the Muse authentication token, which signs in to the user’s Muse account and grants access to chat history and direct control of the assistant.
“From there, Wardle showed three things an attacker can do: read what the user dictated, add extra instructions that Muse trusts and acts on, and capture a token that signs in to the user's Muse account, then use it to read the account's chat history and control the assistant directly.” – The Hacker News
Timeline of disclosure
The proof‑of‑concept was posted on 21 September 2026. The following day, 22 September 2026, The Hacker News published an article detailing the vulnerability and quoting Wardle’s findings.
Meta’s size and financial backdrop
Meta Platforms, Inc. (ticker META) remains one of the largest U.S. technology firms. Its most recent SEC filing (Form 10‑Q filed 30 July 2026) shows:
| Company | Metric | Value | Period | Unit |
|---|---|---|---|---|
| Meta | Revenue | 38,924,000,000 | FY 2018 (ended 30 Sept 2018) | USD |
| Meta | Net income | 42,621,000,000 | FY 2026 (ended 30 June 2026) | USD |
| Meta | Total assets | 449,956,000,000 | FY 2026 (ended 30 June 2026) | USD |
| Meta | Shareholders' equity | 261,221,000,000 | FY 2026 (ended 30 June 2026) | USD |
| Apple | Revenue | 265,595,000,000 | FY 2018 (ended 29 Sept 2018) | USD |
| Apple | Net income | 101,464,000,000 | FY 2026 (ended 27 June 2026) | USD |
| Apple | Total assets | 383,266,000,000 | FY 2026 (ended 27 June 2026) | USD |
| Apple | Shareholders' equity | 107,520,000,000 | FY 2026 (ended 27 June 2026) | USD |
Meta’s 2026 net income of $42.6 bn and shareholders’ equity of $261.2 bn illustrate the scale of the company whose AI assistant is now known to have a local macOS vulnerability. Apple’s comparable figures are provided for sector context, though the vulnerability is specific to Meta’s Muse.
Who is affected and what changes for them
The flaw only impacts macOS users who have installed the Muse app and who run code as the logged‑in user—typically malware already present on the machine or a malicious script executed by the user. For those users, dictation prompts spoken into Muse could be intercepted, altered or used to hijack the assistant’s authentication token.
Meta has not issued a public statement as of the latest filing date (30 July 2026). The company’s SEC filings do not mention the vulnerability, which is consistent with the standard practice of addressing security issues outside of financial reports.
Open questions
Meta has not disclosed whether a patch is forthcoming or whether the hidden preference exists in other platforms (iOS, Windows). Wardle noted that a remote attacker would still need to execute code on the target Mac, but he did not quantify how common such footholds are in the wild.
Until Meta releases a fix, users of Muse on macOS should consider disabling dictation within the app or limiting the app’s permissions, and security teams should monitor for any malicious binaries that attempt to modify endo_voyager_dictation_endpoint.
What comes next
Security researchers will likely test whether similar hidden preferences exist in other AI assistants, and analysts will watch Meta’s response for clues about the company’s broader approach to macOS security. The episode underscores the risk that undocumented local settings pose when AI assistants gain deep integration with operating systems.