Meta Disputes Claim Muse AI Agent Read Private Messages

Meta is pushing back on a report that its AI agent Muse accessed a user's private messages on a Mac without permission. The company says the scenario the journalist described is technically impossible. The journalist says it happened anyway.

The dispute began with a report from Jason Aten, a columnist at Inc. Two Meta executives have since responded publicly. Neither has addressed Aten's explanation of how the access might have occurred, beyond saying it could not have.

What Meta says

Andy Stone, Meta's VP of Communications, answered the report on X. "The Messages integration in the Muse app for Mac is entirely opt-in," he wrote. "You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can't read your Messages unless you do this."

Before Stone's statement, David Singleton, an executive at Meta Superintelligence Labs, had replied to Aten directly on Threads with a more technical account. He said that letting Muse read messages requires "three separate steps of application-level permissions and built-in macOS system-level protections," and that these "can't be circumvented even if the Muse application had a bug."

According to Singleton, the process works like this:

• The user must explicitly grant Muse Full Disk Access.
• Only after that can the user choose an access level for the Messages app: None, Read only, or Read. Without Full Disk Access, these options are grayed out.
• Enabling Full Disk Access opens the macOS Settings interface, where the user has to confirm the choice manually.
• That confirmation forces Muse to restart completely, which makes an accidental grant even less likely.

What the journalist says

Aten's account conflicts with this at a basic point. He reported that Full Disk Access was turned off when Muse read his messages. When he asked the agent how it had done so, Muse said it was syncing his "device notifications." Aten took this to mean the agent was picking up the text of incoming banner notifications on his Mac.

Singleton rejected that explanation as well. He said the AI was confused and described what happened incorrectly. He then pointed to Meta's documentation on Muse's security architecture and its bug bounty process.

In short, Meta's position is that the event Aten describes did not happen and could not have happened.

A trust problem, not just a technical one

Skepticism toward Meta's denial is widespread, and it has a clear basis. The company's record on consumer data includes lawsuits, FTC violations and fines. Only days ago, a New Mexico jury found that Meta had misled users about its data practices, in a case that stems from the 2018 Cambridge Analytica scandal.

Muse is not the only case in question. YouTuber Matt Robb said the agent mishandled a Facebook Marketplace sale, which led to his address being shared. A buyer arrived while he was not home. Meta looked into that case and found it complicated. Robb acknowledged that he had granted Muse a permission that made the outcome possible.

For now, Muse is doing well commercially. It holds the No. 1 spot on the App Store. But whether users trust it is likely to decide whether Meta can compete in consumer AI.

Our Take

The Muse dispute shows a pattern that is becoming familiar with AI agents. When something goes wrong, the agent's own account of what happened can't be relied on. Aten's evidence rests partly on what Muse told him. Meta's rebuttal rests partly on saying Muse was wrong. That leaves users with no clear way to check what an agent actually did on their device.

Similar questions have come up elsewhere, from OpenAI's apology in Australia over agent breaches to a broader FTC probe of AI labs. Permission designs on paper matter less than whether they can be shown to work in practice. It is worth watching whether Meta investigates Aten's case directly, and whether independent researchers test the notification theory. As vendors push always-on agents deeper into personal devices, audit logs a user can check may become more important than a company's denial.