What happened
In a controlled demonstration, redirected dictation exposed the Muse token; the researcher then used that token to inspect chat history and send commands to Muse on another signed-in device.
2026-09-21
HighMedia reportMeta Muse Token-Hijack Flaw Let an Unprivileged Local Process Control the Agent Across Devices
Analysis of the Meta Muse flaw that redirected dictation traffic, exposed an account token, and let a researcher steer the privileged agent across devices.
Meta MuseCredential exposureLocal configuration tampering, agent-token theft, and cross-device assistant hijackMeta Muse for macOS and other devices signed into the same Muse account
Why it matters
Demonstrated unauthorized control of a Muse account and its agent capabilities across devices, potentially exposing files, communications, location, device sensors, purchases, and connected services available to the assistant.
Missing authorization check
Separately authenticated, action-bound authorization before a session token can direct sensitive reads, purchases, data export, sensor access, or cross-device actions.
Would PP block it?
The attacker could still capture the token and influence Muse. At integrated action boundaries, token possession alone would not authorize purchases, protected data export, publication, or sensitive device operations because the request would lack a receipt bound to the action, account, and signer.
Incident analysis
Timeline and technical read
Timeline
2026-09-21
Patrick Wardle publicly discloses the Muse flaw and demonstrates token capture and cross-device agent control.
2026-09-22
Meta says it issued a hotfix for the Muse macOS app after the disclosure.
Technical breakdown
- Muse stored its dictation service destination in an undocumented macOS preference that a process running as the logged-in user could change without elevated permission.
- When the endpoint was redirected, Muse sent dictated prompts and its account authentication token to the attacker-controlled server.
- The captured token authorized access to Muse account history and commands to Muse sessions on other devices signed into the same account.
- Wardle described a ClickFix delivery path in which a victim could be induced to run the single local command needed to redirect the endpoint.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Outside the Muse session, before sensitive connected-service reads, purchases, publication, data export, and protected device actions
- Still needs
- Local configuration integrity, ClickFix prevention, session-token confidentiality, prompt secrecy, and action paths that do not enforce receipts remain outside coverage.
- Receipt required for
- Purchases, protected data reads or exports, publication, sensitive sensor access, and consequential actions on another signed-in device
A Credential Gate can require a distinct signer and receipt before the hijacked agent performs protected reads or external mutations, but Permission Protocol does not prevent the local preference change or theft of the Muse session token.
Start small
Put the relevant gate at this action boundary.
This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.