The voice story runs on three tracks. What shipped: a genuinely best-in-class transcription model, a voice mode, and live video chat with a customizable voice. What broke: a dictation flaw patched in about a day, and a 6.8 GB filesystem export that Meta says is a feature. What's pending: phone calls to real businesses, still in limited testing after a human-contractor experiment went sideways. Each track changes what the others mean, so take them in order.
The transcription model is the real product here
On September 1, before the Muse agent even launched, Meta Superintelligence Labs released Muse Voice Transcribe: a real-time audio model that combines streaming speech-to-text, speaker diarization for 20+ speakers, and end-of-speech detection in a single model. It re-evaluates its audio buffer every 80 milliseconds and commits to a transcript about 0.16 seconds after a speaker stops talking.
The numbers are Meta's, the ranking is independent. Artificial Analysis ranked it first on its streaming transcription leaderboard at a 3.1% word error rate. Pricing is $3 per 1,000 audio minutes, roughly $0.18 an hour, which Meta positions at about one-fifth of Google's standard rate. It is available through the Meta Model API, Meta AI for Mac, and Muse Code. Meta trained it on more than 70 languages and verified 25 at launch. There is a zero-data-retention tier on the Model API for privacy-sensitive developers.
The honest boundary: Meta's own docs say it is speech-to-text only. It does not synthesize speech and it does not provide a speech-to-speech conversation API. The model turns audio into text; whatever conversational voice the agent uses is a separate layer on top.
Voice Transcribe is a developer and API product first, an agent feature second. When coverage says "Meta's voice model beats Google," it means this model, on this benchmark. That is real, and it is narrower than it sounds.
Voice Mode, video chat, and the avatar
At Connect, Meta presented Muse Voice Mode: long conversations with the agent while it keeps working in the background. The day after the keynote, chief AI officer Alexandr Wang demoed live video chat on X: you talk to Muse face to face, and you can prompt how it sounds. The research writeup behind it describes Realtime Avatar as an extension of the voice model, generating speech and video from a shared stream so the voice, lip movement, and expression stay synchronized. It can animate a reference image during a live conversation, from a portrait to an illustration.
One thing to keep straight: custom voice generation is in internal testing only, per TestingCatalog's September 10 report, with no public date. A video call with a face and a custom voice is the demo; the shipped surface is voice mode, with the fancy voices still behind a lab door.
The dictation zero-day, patched in a day
On September 21, macOS security researcher Patrick Wardle published a proof of concept called "not-a-mused" showing that any unprivileged local process could flip an undocumented Mac app setting, `endo_voyager_dictation_endpoint`, and reroute Muse's dictation traffic to an attacker-controlled server. Dictate a prompt and your words go to the attacker's server instead of Meta's. From there, Wardle showed, an attacker could read dictated content, inject instructions the agent trusts, and steal the authentication token that signs in the Muse account.
The demo went further than audio. From a compromised Mac session it queried Muse's inventory of the user's devices, pulled a linked iPhone's location, and started a Bluetooth scan, all through the Muse client with nothing appearing on screen. Wardle was blunt: he told reporters people should not install the assistant.
Meta hot-fixed it within about a day. Wardle's post on September 22 reads "Hooray, hot-fixed!" and he praised the speed. He has said he will share more bugs at the Objective by the Sea security conference, so this episode may not be over.
The fair caveats. Singleton's framing is that this was a local privilege escalation attack, not a remote exploit: it requires malicious code already running on the machine under the user's account. Wardle disputes the narrow version, arguing a ClickFix social-engineering attack could deliver the hijack as a remote vector. No CVE was assigned. And this was a conventional local-access software bug underneath a product with unusually broad permissions, not a model-behavior failure. That is arguably the more fixable category, and the more honest lesson: an assistant that holds your files, microphone, camera, location, calendar, and linked devices is a disproportionately valuable hijack target. The setting name will be forgotten; that asymmetry won't be.
Update the Mac app, don't run untrusted scripts, and review which accounts and permissions you have connected. The exploit needed code already on your machine, but Muse widens what such code can reach.
The 6.8 GB export, ruled "not a bug"
Developer Peter James asked Muse to archive the files it could reach and send them to his connected Google Drive. It did: roughly 2.7 GB compressed, 6.8 GB unpacked. The archive was not his content. It was the root filesystem of the Linux environment assigned to his session: Ubuntu system files, internal documentation, integration code, app templates, memory files, agent logs, and SSH key files (James did not establish whether the keys were active or what they could reach). A dev.to roundup of the same week documents a second researcher who exported a 2.7 GB zip of the agent's own cloud VM filesystem: runtime, credential manuals, an unreleased connector list.
Meta closed the bug-bounty submission as "Not Applicable" and did not answer Ars Technica's questions. The post hit the Hacker News front page with 204 points.
Then Meta's position flipped the story. A September 25 update to a security explainer reports Meta's line: exporting your own VM filesystem is intended behavior. "Muse users can export their own VM filesystem; Meta calls it intended." David Singleton has said the transparency is deliberate: a file explorer in the Library tab shows every file, and Settings > Data controls > Download your agent data does the same.
Both things can be true. The export working as designed says the feature is transparency; the bounty closure says Meta never saw it as a boundary violation. What it leaves unanswered is the scope of the Sentinel's approval policy. Meta's claim is "nothing reaches the internet unless the Sentinel approves it." That appears to be true, and the Sentinel's policy clearly covers a lot more than launch copy implied.
Phone calls: finally in limited testing, minus the humans
The one question our launch-week research couldn't answer now has an answer. Fox News reported October 3 that Meta is testing outbound calling: some Muse users can ask the agent to call US businesses, book haircuts, check whether a store has an item in stock, get quotes from contractors, with a transcript afterward. It remains in limited testing rather than broadly available. Meta has not announced separate pricing for calling; paid plans are still reported at $20 and $100 a month. This also confirms an earlier datapoint: inviters who hit the referral cap got early access to phone calls.
The rollback story is the part to read carefully. Reuters reported September 22-23 that Meta had quietly routed some Muse calls to human contractors without disclosure. Employees raised privacy objections on internal channels, including the sharp one: a bug could leak unnecessary information to call-center contractors. One employee found a contractor had made a racist remark on a cable-bill negotiation call. A Meta VP acknowledged it "was a miss" and said the feature was rolled back for now.
The uncomfortable detail: internal tests put human callers at 95 to 98 percent success, versus a lower rate for AI-only calls. That gap is why businesses keep hanging up on the AI, and why Meta was tempted. Meta says any public release would carry proper disclosures and safeguards, and that it is still working on AI calling.
A phone call is the highest-trust surface in the agent's job list: it confirms details, agrees to things, and negotiates in your name. Before you hand Muse your phone, know exactly where its authority starts and ends, and read the transcript.
What's still in the workshop
TestingCatalog spotted two features being prepared in a recent Muse web build: a dedicated screen-view tab, where you watch the agent's virtual computer while it works, and an updated web-based voice mode that resembles a phone call with the agent. Meta officially presented voice mode at Connect as long conversations while the agent works in the background. Muse's own email address is also expected. None of these have shipped. Screen view is the one to watch: an agent that shows you its screen answers the transparency complaint, and an agent that always watches the screen raises a new one.
What to watch
I'll update this page when there's movement on any of these: the web voice mode and screen-view tab shipping, and what permissions the screen view inherits; a second independent check of the dictation fix; phone calls moving past limited testing with published pricing and disclosures; the Confidential VM, the user-held-encryption-key version that would make Meta's "can't see your data" claim cryptographic instead of policy-based, promised later this year with trusted testers.
Quick answers
Does Muse have voice input?
Yes. Muse Voice Transcribe, released September 1, 2026: real-time streaming speech-to-text with 20+ speaker diarization and end-of-speech detection, available through the Meta Model API, Meta AI for Mac, and Muse Code. Independent testing (Artificial Analysis) ranked it first on the streaming transcription leaderboard at 3.1% word error rate.
Can Muse hold a voice conversation?
Meta presented Voice Mode at Connect for long conversations while the agent works in the background, and Alexandr Wang demoed live video chat with a customizable voice and avatar on September 24. Custom voice generation is still in internal testing.
Can Muse make phone calls for me?
It is in limited testing. Per Fox News (October 3), some users can ask Muse to call US businesses, with a transcript afterward. No separate pricing has been announced. Meta previously tested human contractors quietly placing some calls and rolled that back after employee privacy objections.
Was the dictation flaw real?
Yes, and it was patched in about a day. Researcher Patrick Wardle showed that a Mac app setting could be changed by unprivileged local code to redirect dictated audio to an attacker-controlled server. Meta hot-fixed it on September 22.
Can I download Muse's own files?
Apparently yes, by design. A researcher exported 6.8 GB of his session's VM filesystem through an ordinary conversation; Meta closed the bug-bounty report as "Not Applicable" and later called the export intended behavior.
Frequently Asked Questions
Q: What is Muse Voice Transcribe?
A: Meta Superintelligence Labs' real-time audio model, released September 1, 2026: streaming speech-to-text, speaker diarization for 20+ speakers, and end-of-speech detection in one model, re-evaluating audio every 80 milliseconds. Independent testing (Artificial Analysis) ranked it first on the streaming transcription leaderboard at 3.1% word error rate. Pricing is $3 per 1,000 audio minutes, roughly $0.18 an hour, via the Meta Model API. It is speech-to-text only: Meta's own docs say it does not synthesize speech or provide a speech-to-speech API.
Q: Is voice dictation on Mac safe now?
A: The September 21 flaw (an undocumented dictation-endpoint setting, redirectable by unprivileged local code) was hot-fixed by September 22, per researcher Patrick Wardle's own confirmation. The exploit required code already running on your Mac, and no CVE was assigned. The durable lesson: an agent with broad permissions is a high-value hijack target, so keep the app updated and avoid untrusted scripts.
Q: Why did Meta say the 6.8 GB export was not a bug?
A: Meta's position, reported in a September 25 security update, is that exporting your own VM filesystem is intended behavior: a file explorer in the Library tab and Settings > Data controls > Download your agent data do the same. The bug-bounty report was closed as "Not Applicable." What remains unanswered is the scope of the Sentinel's approval policy for outbound data.
Q: Will a human ever be on my Muse calls?
A: Meta tested it and rolled it back. Reuters reported contractors quietly placed some Muse calls; after employee privacy objections and a contractor's racist remark on a cable-bill call, a Meta VP called it "a miss" and suspended the test. Human callers reportedly hit 95 to 98 percent success versus a lower AI-only rate. Meta says any public release would carry proper disclosures.
Comments