News · 2026-09-23

Muse local-client flaw could turn the agent's own privileges against its user

A public proof of concept showed that local macOS code could redirect Meta Muse's dictation traffic, obtain a Muse authentication token, inject prompts and act with the personal agent's privileges. The vulnerability matters because an AI agent with many integrations becomes a high-value privilege amplifier even when its cloud sandbox remains intact.

Key facts

• Security researcher Patrick Wardle published the not-a-mused proof of concept.
• The chain begins with local code execution and an undocumented dictation-endpoint setting.
• It is not a demonstrated remote exploit and no in-the-wild exploitation was established.
• Primary source: Wardle's proof of concept.

The vulnerable setting was endo_voyager_dictation_endpoint. Wardle's demonstration says an ordinary local process could alter it without special privileges. Redirecting the endpoint sends dictated traffic to an attacker-controlled server; the demonstration then captures authentication material, injects prompts and uses the legitimate agent session. The chain is simple enough to remember: local code execution becomes endpoint rewrite, endpoint rewrite becomes token capture, and token capture becomes control through the agent's own authority. Ars Technica's report describes Meta as characterizing it as “not a remote exploit.”

Think of a concierge with keys to a building, a calendar, packages and a phone. The weakness does not pick the building lock from the street; it gets inside the concierge's office and replaces the phone number on their instruction card. The resulting harm can be broad because the concierge already has legitimate access. That is the important AI-security connection: prompt injection is dangerous when the prompt reaches an agent that can actually do things.

A second report by Mouse needs to remain separate. A user asked Muse to archive session-visible files to Google Drive, receiving an approximately 2.7 GB compressed and 6.8 GB unpacked archive. It reportedly contained internal documentation, integration and runtime code, about 68 skill directories, agent records and SSH key files. The report did not show that keys were active, that another user's data was present, or that the Linux container or host was escaped. Meta's security architecture says users receive dedicated cloud VMs and the agent runs in an isolated runtime cell; the report did not disprove those claims.

Wardle's finding is the harder operational lesson. Security programs often focus on cloud isolation and least-privilege service accounts, but the desktop agent client, microphone path and connector credentials are equally security-critical. Meta reportedly hotfixed the problem, but the dossier could not verify a fixed build, CVE or detailed advisory. Until those are public, teams should assume that endpoints, token storage and agent-facing local settings deserve the same review as a browser's credential store.

Primary source, verified: read the paper →

Ground Truth. (2026, September 23). Muse local-client flaw could turn the agent's own privileges against its user. Ground Truth. https://groundtruth.day/news/meta-muse-local-client-token-prompt-injection.html

@misc{groundtruth:meta-muse-local-client-token-prompt-injection,
  title  = {Muse local-client flaw could turn the agent's own privileges against its user},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/meta-muse-local-client-token-prompt-injection.html}
}

Topics: cybersecurity · ai-security · prompt-injection · agents · vulnerabilities · meta