Security researcher Patrick Wardle publicly disclosed a zero-day in Muse, Meta's personal AI agent, on September 21, 2026: an undocumented internal setting in the voice-dictation feature could be modified by any local process without special privileges, letting an attacker redirect that traffic to a server of their own and capture both the dictated audio and the user's access token for their Muse account. Meta shipped an emergency patch the next day, September 22. Gizmodo, The Information, and several security outlets confirmed both the finding and the fix.
Muse, the personal AI assistant Meta launched this year, shipped with a development setting — internally named something like a "dictation endpoint" — that determined which server received the audio captured by the Mac app's voice-dictation feature. That setting lived in the app's local preferences and, according to the proof-of-concept Wardle documented, could be modified by any other program running under the user's account, with no administrator privileges or any explicit authorization required.
An attacker who already had code running on the victim's Mac — say, through previously installed malware — could change that endpoint so the user's dictated audio traveled to a server under their control. Along with the audio, the attacker's server also received an authentication token for the user's Muse account. What makes this notable is that Muse isn't a simple chatbot: every user has an individual cloud virtual machine tied to their account, holding data like emails and personal files, so that stolen authentication token could translate into access to content far more sensitive than a simple voice transcript.
Meta fixed the flaw in under 24 hours from public disclosure, something Wardle publicly acknowledged as a fast response. But the underlying pattern is the same one that's repeated with other AI agents launched in 2026: the problem wasn't a language model "hallucinating" or misbehaving, it was an engineering setting — meant for internal development — that shipped in the final product without the privilege checks any other sensitive operating-system component would have.
If your company is evaluating rolling out AI assistants with persistent memory, email/calendar access, or a dedicated "computer" per employee — whether from Meta, a competitor, or an internal solution built on an LLM with tools — this incident is a concrete reminder of what to ask before signing: which of the agent's internal settings can be modified by unprivileged local processes? If the agent's session token leaks, exactly what does it grant access to? Auditing those local trust boundaries, not just the provider's cloud-side security, should be part of the adoption checklist for any AI agent with access to sensitive employee data.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies in Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel