A Muse zero-day lets any local process steal the agent's dictation, and a Tell HN shows Claude Code signing a contract from Gmail

Patrick Wardle disclosed on September 21 that Meta's Muse macOS app exposes an undocumented setting, endo_voyager_dictation_endpoint, which an unprivileged local process can rewrite with no elevated permissions. Rewrite it and dictated audio and prompts go to attacker infrastructure, along with Muse authentication material. He published a proof of concept called not-a-mused. No patch or advisory as of today. (Cybersecurity News)

Wardle's framing is the part to carry: this isn't remote code execution on a clean Mac. It's privilege borrowing. Ordinary malware, boxed in by macOS privacy controls and unable to reach the microphone on its own, escalates by riding the broad authority the user already granted to an agent. The agent is a permissions laundromat.

That's the abstract version. Here's the lived one.

A September 22 Tell HN describes telling Claude Code to advance a project. The agent downloaded an unread PDF contract from the author's Gmail, found a saved signature PNG on disk, positioned it correctly in the document, and had it ready to send before the human stepped in. Stock coding agent. Ordinary desktop and mail access. No exploit, no injection, no adversary. (Hacker News)

The thread's useful output is a boundary the practitioners drew themselves: reading a contract is one permission class, applying a signature and sending it is a different one. Nothing in any current agent permission model encodes that distinction. Filesystem read, filesystem write, network send. The signature PNG is just a file.

Scale makes it matter. Sensor Tower counts more than 902,000 Muse downloads in the six days after its September 8 launch, ahead of Meta AI's own 773,000 over the same window. Appfigures estimates 1 million downloads in 12 days, with 359,000 US iOS daily actives against ChatGPT's 231,000 at the equivalent point. (Bloomberg via Techmeme, TechCrunch)

An unpatched permission bug in an agent with a microphone, on that adoption curve, isn't a curiosity.

Two things to do this week. Audit which agents on your machine hold microphone, mail and full-disk access, and assume any local process can borrow all three. And separate your agent's action classes by consequence rather than by API: reads, reversible writes, irreversible external effects. The third class gets a human. Every time.