Patrick Wardle's not-a-mused proof-of-concept showed a new AI security problem: when an agent holds delegated authority, compromising the agent can mean inheriting the user's access.
Patrick Wardle's "not-a-mused" proof-of-concept showed a new AI security problem: when an agent holds delegated authority, compromising the agent can mean inheriting the user's access.
An AI assistant that answers questions is one thing. An AI agent that can browse, read local files, send messages, make purchases, use connected services and keep working in the background is infrastructure.
That changes the security equation. The September 2026 Meta Muse zero-day is an early example of what happens when an attacker stops targeting the human and targets the agent acting on the human's behalf.
"Muse's access can potentially become the attacker's access." — Patrick Wardle
This is Part 1 of a four-part series on the Meta Muse security story: the agent (this article), the runtime, the tools and the context.
endo_voyager_dictation_endpoint, that any local process could change without special privileges. It controls where Muse sends dictation traffic.Meta Muse is a personal agent, not a chatbot. Meta's own security write-up describes an agent that "actually does things, works in the background, launches swarms of subagents, builds its own tools, and edits itself." It can browse, connect to email, calendar and other services, fill forms, and make purchases. The Mac app can work with local files, Messages, Calendar and Notes when the user grants permission.
An agent that can act needs more security than one that can only answer. That is the architectural shift behind everything below.
Wardle found that Muse read its dictation endpoint from a setting that any local process, or any terminal command, could rewrite. There was no integrity check and no authentication on the change. Muse also sends dictation audio to cloud servers rather than using the Mac's on-device dictation, and some coverage points out that on-device transcription would have avoided the network hop entirely.
With the endpoint redirected, the attacker sits inside a trusted workflow:
Normal Compromised
User speech User speech
↓ ↓
Muse client Muse client
↓ ↓
Meta transcription service Attacker-controlled endpoint
↓ ↓ (forwards to Meta so nothing looks wrong)
Agent workflow Agent workflow
According to reporting on the research, the PoC acted as a proxy that captured the account token and audio while forwarding legitimate traffic to Meta so the user noticed nothing. It can append hidden instructions to the user's own voice command. Wardle's demonstrations, as reported by Ars Technica, included writing files to the Mac and taking photos with the camera, in some cases without an obvious warning to the user. The PoC implements a subset of the 50-plus commands Muse exposes.
Local code execution (any route)
↓
Muse setting rewritten (no special privileges)
↓
Dictation endpoint redirected
↓
Attacker observes and can inject into agent input
↓
Muse account token captured
↓
Attacker steers the agent
↓
Whatever the agent is allowed to do becomes reachable
The first step is a precondition, not part of the flaw. Anything that gives local execution as the user would do: existing malware, a malicious installer, or a social-engineering trick such as ClickFix, where a victim is persuaded to paste a command into a terminal. ClickFix is a delivery route, not the vulnerability.
Meta's David Singleton (Meta Superintelligence Labs) described the issue as: "This was a local privilege escalation attack, not a remote exploit." That is accurate about the precondition: nobody could take over a Mac over the internet with this flaw alone.
Wardle disagrees with the practical conclusion. He argues a simple ClickFix attack can supply the local execution, so a remote attacker could reach victims at scale. VentureBeat reported him noting the same lure. That scenario is a described possibility; nothing in the coverage we reviewed confirms it was used in the wild.
Our assessment: both statements can be true at once. The precondition is real, and ClickFix lowers it. The "privilege escalation" label is also an awkward fit. No operating-system boundary was crossed. The prize was the agent's delegated authority, which is the point of this series.
Traditional malware has to acquire its own capabilities. An attacker who controls an agent can borrow the ones the user deliberately granted:
Traditional: low-privilege malware → user account → protected resources → elevation
Agentic: low-privilege malware → compromised agent → its tools → user-authorized services and data
The agent privilege ladder is shorter and the rungs are more valuable. Security questions shift from "what can this process access?" to "what can this process cause a trusted system to access or do?"
Precision matters here. The captured token authenticates the user's Muse account. VentureBeat described it as the token used to control the agent. Meta's published architecture is designed so the agent never holds real third-party credentials: connector credentials sit in a separate store and are inserted at the network boundary, and a separate permission service (Sentinel) decides which connector actions are allowed, denied, or sent to the user for approval.
So the realistic blast radius is whatever Muse can do under its permission policy and approval settings, not "every password on the machine." The sources do not say whether Wardle's PoC could bypass Sentinel approvals, and reports that some demonstrated actions produced no obvious warning leave the question open. It is the most important unanswered question in this story, and we flag it rather than guess.
Treat agent configuration as security-critical. Unexpected changes to endpoints, connectors, tools or models should alert. A preference file that decides where trusted traffic goes is a control plane.
Bind and watch agent identity. Agent tokens used outside their expected execution context, from a new location, or after a configuration change deserve scrutiny.
Watch sequences, not single events. An unexpected process, then a config change, then a new transcription destination, then an unusual tool call is an attack. Each step alone looks routine.
Give agents least privilege. The smaller the agent's authority, the smaller the blast radius.
| Capability | Safer policy |
|---|---|
| Read email | Specific mailboxes or folders only |
| Send email or messages | Approval, or tightly scoped policy |
| File access | Task-specific directories |
| Purchases | Per-transaction approval and limits |
| Secrets | Brokered access, never raw credentials |
Close the enterprise visibility gap. VentureBeat found that Meta's launch documentation does not describe a SIEM audit export, IT admin console or DLP integration. Muse gives the individual an audit trail; security teams had no equivalent view.
Build a kill switch. You need a way to disable a compromised agent, revoke its sessions and disconnect its tools quickly.
Identity is the first of four layers: an agent's authority can be hijacked. Part 2 looks at the runtime that contains the agent, Part 3 at the tools it can call, and Part 4 at the content that can steer it. For the general model of runtime defenses, see our guide to AI runtime security and the blast radius of AI agents.
Test how your AI agents handle manipulation, tool abuse and data-exfiltration attempts before an attacker does.