Local Code Could Redirect Muse and Borrow Its Access
Not A-Mused research describes a Muse dictation override for code already running as the Mac user. It is no remote drive-by: the concern is borrowing a trusted agent’s existing access after that foothold.
The undocumented endo_voyager_dictation_endpoint preference diverts requests to an untrusted proxy without breaking upstream encryption. The demonstration can observe speech transcripts, capture an account bearer token and optionally substitute returned text, influencing subsequent instructions.
The code inspects chats, devices and advertised commands, and requests selected actions. Existing approvals apply, including camera permission. Confidential virtual machines needing recovery credentials are excluded.
Different controls protect different boundaries
Meta’s security explanation describes separating agent execution, stored service credentials and action approval. Its destination-scoped permissions and independent enforcement are vendor design claims, not tests performed here or confirmation that this particular local override has been fixed.
The current product page and design explanation describe connected applications and visible approvals. Repositories, cloud consoles, internal documents or automation can widen consequences when such access exists; their mention is conditional context, not evidence that this demonstration compromised every integration.
Six checks for agent deployments
- Protect endpoint configuration. Security-sensitive routing preferences need controlled changes rather than silent redirection.
- Constrain authentication. Bind credentials and grants to their intended recipient, purpose and action; avoid broadly reusable authority.
- Expose destinations. Make request routing visible and resistant to hidden alteration, alongside activity and permission records.
- Reduce connected privileges. Grant only necessary accounts, tools and data; distinguish reading from writing.
- Record changes. Trace endpoint changes, token use and unexpected tool calls without recording secret values.
- Investigate local expansion. Existing user-level execution does not settle what a more trusted agent could subsequently reach.
The repository’s three visible commits are dated 21 September 2026. This review read the code without executing it and does not establish current vendor remediation.
