Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Meta Muse Mac hidden dictation endpoint security flaw

Vulnerability
First reported
Last updated
Happening score
H score 37
1 unique sources, 2 articles

Summary

Hide ▲

Meta's Muse assistant for Mac has a now-patched flaw that let an unprivileged local process redirect dictation traffic, capture dictated audio and prompts, inject trusted prompts, and abuse the app's access. Security researcher Patrick Wardle also tied the issue to the undocumented endo_voyager_dictation_endpoint setting, which could be changed by a program running as the logged-in user. The exposure sits within the broader risk Apple highlighted for Full Disk Access on macOS, where apps with elevated privacy permissions can reach files, mail, messages, and browsing history. Apple said it plans to tighten FDA controls so that this kind of access is granted only with explicit user action.

Related Happenings

Apple macOS Full Disk Access access-control tightening

Advisory/Mitigation
H score20 First: 05.10.2026 13:38 Last: 05.10.2026 13:38 Sources 1

How related: Apple said it plans to introduce updates to the setting to ensure that this sort of access is granted only with an explicit user action.

About this happening: Apple is tightening Full Disk Access in macOS, requiring an explicit user action before apps can gain broad access to files, mail, messages, browsing history, and othe...

Open Happening

OpenAI ChatGPT app for Mac unauthorized access vulnerability (CVE-2026-100754)

Vulnerability
H score1 First: 05.10.2026 13:38 Last: 05.10.2026 13:38 Sources 1

How related: Wardle has also been acknowledged for reporting another vulnerability, tracked as CVE-2026-100754, impacting OpenAI's ChatGPT app for Mac that could have been abused to take over the AI assistant and grant an attacker unauthorized access to chat logs and other data stored by the app.

About this happening: CVE-2026-100754 exposed OpenAI's ChatGPT app for Mac to unauthorized takeover, putting stored chat logs and other app data at risk. The flaw could let an attacker ta...

Open Happening

WebKit memory corruption, out-of-bounds write, and use-after-free flaws (multiple vulnerabilities)

Vulnerability
H score1 First: 30.06.2026 10:15 Last: 30.06.2026 10:15 Sources 1

About this happening: WebKit now has four patched vulnerabilities, including CVE-2026-43707, CVE-2026-43716, CVE-2026-43745, and CVE-2026-43715, that can be triggered by malicious...

Open Happening

MacOS XPC cached signature trust privilege escalation privilege-escalation flaw

Vulnerability
H score23 First: 25.06.2026 14:00 Last: 25.06.2026 14:00 Sources 1

About this happening: macOS XPC trusted software verification lets a non-root user abuse cached signature trust to call privileged helper functions without authentication, opening a route to ...

Open Happening

Beats Studio Buds Bluetooth BR/EDR missing-authentication security flaw (multiple vulnerabilities)

Vulnerability
H score24 First: 18.06.2026 15:23 Last: 18.06.2026 15:23 Sources 1

About this happening: Beats Studio Buds are affected by CVE-2025-20701, a missing-authentication flaw in Airoha system-on-a-chip (SoCs) and the Bluetooth BR/EDR radio that can let a...

Open Happening

Timeline

  1. 22.09.2026 09:33 2 articles · 13d ago

    Proof-of-concept shows Meta Muse for Mac can be redirected through a hidden dictation endpoint

    Initial Disclosure

    Security researcher Patrick Wardle released a proof-of-concept showing that malware already running as the logged-in user can change the undocumented endo_voyager_dictation_endpoint preference in Meta's Muse for Mac, redirecting microphone dictation away from Meta and toward an attacker-controlled endpoint. Wardle said an attacker can read what the user dictated, add extra instructions that Muse trusts and acts on, and steal the Muse session token to control the assistant directly.

    Show sources
    Open in new tab
  2. 22.09.2026 09:33 2 articles · 13d ago

    Mac users are told to quit or remove Muse and avoid voice input until Meta fixes the flaw

    Mitigation Patch Update

    Mac users are advised to quit or remove Muse, review and revoke unnecessary permissions, avoid voice input, and change passwords for connected accounts if the Mac may already be compromised. The guidance closes the path shown by the hidden dictation redirection and reduces what a local attacker can access through the app.

    Show sources
    Open in new tab