Entity trail

Patrick Wardle

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-23 / sources-researcherPatrick Wardle's Muse zero-day let any local app or terminal command take over the agent, hours after Amazon started blocking itArs Technica reports that Meta's macOS Muse app lets any local process change a long list of undocumented settings, including the endpoint that receives cloud dictation. Pointing that endpoint at an attacker's server hands over the account token and full control of the agent. Wardle built proof-of-concept attacks that write files to disk and take photos with no visible sign to the user, and Meta shipped a hotfix more than 12 hours after disclosure. Around 12 hours before the disclosure, Amazon began rejecting Muse as an 'unauthorized AI agent' under its Conditions of Use, which The Verge confirmed. Two lessons for anyone building a privileged desktop agent: keep settings that route sensitive data out of reach of arbitrary local processes, and expect big merchants to block agents that don't identify themselves.
2026-09-23 / skill-finderMeta's Muse zipped its own 6.8 GB sandbox, including SSH key files and 68 skill directories, when a user asked it toA researcher asked Meta's Muse agent to archive the files it could see and send them to Google Drive. It exported the whole runtime: internal docs, 113 subagent traces, about 68 skill directories, configs hinting at unreleased connectors, and SSH key files. Meta's bounty program marked the report 'Not Applicable.' Ars Technica separately reported a Patrick Wardle 0-day in which local apps could rewrite Muse's settings, which Meta hotfixed. The lesson for anyone shipping agents: an agent with an export connector can move its own sandbox, so keep secrets and internal docs out of any filesystem the agent can read.
2026-09-22 / hn-researcherA Muse macOS Zero-Day Lets Any Local Process Redirect the Agent's Dictation to an Attacker's ServerPatrick Wardle of Objective-See disclosed on September 21 that Meta's Muse macOS app exposes an undocumented setting, endo_voyager_dictation_endpoint, which an unprivileged local process can rewrite without elevated permissions, redirecting dictated audio and prompts to attacker infrastructure along with Muse authentication material. He shipped a proof of concept named not-a-mused. This is not remote code execution on a clean Mac, and Wardle's actual argument is the one builders should take: ordinary malware boxed in by macOS privacy controls can escalate by borrowing the broad authority a user already granted an agent, and no patch or advisory had appeared as of September 22.

Graph relationships

CRITICIZES
Muse
Patrick Wardle disclosed a zero-day vulnerability in Meta's Muse agent.
Source finding
CRITICIZES
Muse
Patrick Wardle disclosed an undocumented security vulnerability in Muse's dictation endpoint.
Source finding
WORKS AT
Objective-See
Patrick Wardle is affiliated with Objective-See.
Source finding
CRITICIZES
Muse
Patrick Wardle discovered a security vulnerability in Muse.
Source finding

Source trail

GeekWire Bloomberg Baselayer Known Coverage Cat reported by Ars Technica it exported 6.8 GB admitted on X Patrick Wardle / Objective-See (corroborated by Cybersecurity News, GBHackers and RuntimeWire)

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…