Meta’s Muse faces questions over access to private messages

Meta’s Muse is supposed to help with your digital life. But a dispute over its access to private messages raises a basic question about exactly how much users are letting it see.

In a Sept. 19 column for Inc., tech writer Jason Aten said he installed Muse on his iPhone and Mac and asked it to research his background and suggest ways it could help. Later, he said, the agent suggested a story idea based on a private text conversation with his podcast co-host, Stephen Robles, about the new iPhones. It also flagged a message from his editor about a deadline.

“I never gave it permission to read my messages,” Aten wrote. He said he remembered explicitly declining access to his messages, calendar, and other personal information during setup.

So he asked how it knew what he was texting. Muse claimed the Mac app was passing along incoming notification banners. “It’s the incoming notification stream only, not access to your texts,” the agent told him, according to Aten. But Aten said his investigation suggested Muse had synced his local Messages database, reaching row 187,462. That isn’t necessarily a count of individual messages, but his account suggests access beyond incoming notifications. He also said Muse’s settings showed Full Disk Access was disabled.

Screenshots of Jason Aten questioning Meta’s Muse about its access to his private messages.
Credit: Screenshot/Jason Aten

Meta is pushing back: “The Messages integration in the Muse app for Mac is entirely opt-in,” Meta communications executive Andy Stone wrote in a Sept. 29 post on X. “You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can’t read your Messages unless you do this.”

Stone was responding to a post citing AppleInsider’s claim that Muse was uploading Apple Messages to the cloud even after being explicitly told not to. He added that access “can be revoked at any time.”

This Tweet is currently unavailable. It might be loading or has been removed.

Meta also rejected Muse’s own explanation. In his response on Threads, Meta Superintelligence Labs executive David Singleton said the agent’s claim about notification banners was incorrect. Singleton described “three separate steps of application-level permissions and built-in macOS system-level protections” required to access Messages, saying they “can’t be circumvented even if the Muse application had a bug.” Users must grant Full Disk Access through macOS settings, which triggers an app restart, and select a Messages access level within Muse, he explained.

“No one should be surprised that an AI Agent is reading their messages, regardless of what they clicked,” Aten warned.

The disagreement follows another report this week of Muse doing more than a user expected it to. As Mashable previously reported, YouTuber Matt J. Robb said the agent shared his address with a Facebook Marketplace buyer and arranged a pickup without first checking with him.

Meta introduced Muse earlier this month as a personal AI agent that can work across connected apps, negotiate on a user’s behalf, and continue working after the app is closed. But as users hand over more tasks to Muse, they’re also reporting more instances in which its actions catch them off guard. How Meta addresses those reports could shape how much people are willing to trust it with next.