Meta denied that its artificial intelligence (AI) agent Muse had accessed a user's private messages without authorization. The statement came after journalist Jason Aten, columnist at Inc., claimed that the system had accessed the message database of his Mac even after he did not grant permission for it.
According to Aten, Muse began suggesting ideas for a column after he conversed with the co-host of his podcast about the new iPhones. The agent also mentioned a message sent by his editor regarding the preparation of a text.
The issue, according to the journalist, is that he had not asked Muse to analyze his messages and claims he had explicitly chosen not to grant access to them, as well as to his calendar and other personal information.
When he questioned Muse itself about how it had discovered the content of the conversations, the agent responded that it did not have access to the message history. The explanation given was that the Mac app was merely receiving the text from the notifications displayed on the screen.
Aten, however, claims he investigated the computer's files and found evidence that Muse had synced data from the local Messages app database. According to him, the synchronization had reached line 187.462 of the database.
Meta says access depends on two permissions
- Meta contested Aten's conclusion;
- Andy Stone, the company's communications vice president, stated that the integration of Muse with the Messages app on Mac is completely optional;
- According to him, the user needs to enable both Full Disk Access, a macOS feature that grants expanded access to the file system, and the Messages connector within Muse;
- “You need to enable both Full Disk Access and the Messages connector so that Muse can read the content of your messages. It cannot read your messages without you doing this,” wrote Stone on X.
David Singleton, an executive from Meta Superintelligence Labs, provided a more detailed explanation. According to him, the access involves three distinct permission steps within the app and the system protections of macOS itself.
First, the user needs to authorize Full Disk Access. Then, they can set the access level of Muse to the Messages app — no permission, read-only, or read content. Without Full Disk Access, these options remain disabled.
The activation of expanded access also requires an additional confirmation in macOS settings and causes a complete restart of Muse, according to Singleton. For the executive, these protections would prevent access from being granted accidentally or without the user's knowledge.
When questioned, Muse could appear on a dedicated Meta device – Image: Disclosure/Meta
Journalist says that Full Disk Access was disabled
Aten's report conflicts precisely on this point.
The journalist claims that when he discovered the message synchronization, the Full Disk Access was disabled in the Muse settings on his Mac. He also says that the permission did not appear among the authorizations granted to the app in the computer's security and privacy settings.
Aten also questioned the explanation provided by Muse itself about the notifications. According to him, the agent would have stated that it only received the text of the notifications displayed on the Mac, and not the content stored in the Messages app.
Singleton contested this explanation. According to the executive, Muse had confused when answering the question and provided an incorrect explanation about the origin of the information.
The official position of Meta, therefore, is that the scenario described by Aten could not have occurred as reported, because the app's protections and macOS security would require the mentioned permissions.
Read more:
- Remember the Tamagotchi? Meta is working on a device equipped with AI to use the Muse
- Muse, Meta's AI agent negotiates keyboard and shares user address with buyer without warning
- Muse: What to expect from Meta's AI agent in Brazil
Case reignites discussion about the privacy of AI agents
The incident occurs just weeks after the launch of Muse, presented by Meta as a personal agent capable of performing tasks on behalf of the user.
The company claims that the system was developed with a focus on security and privacy and that people can choose which apps to connect to the agent and determine how much access it will have. Muse was also designed to request authorization before certain sensitive actions.
However, the case of the messages is not the only recent incident involving the agent. Another user, YouTuber Matt Robb, claimed that he used Muse to help him sell a product on Facebook Marketplace and that the system ended up sharing his address with a potential buyer. The buyer even showed up at the provided address while Robb was not home.
In this case, however, there was a different explanation. Robb later stated that he had selected an option called “Allow Always” and that he did not realize that this choice would allow Muse to send messages automatically in his name. The Meta is analyzing the incident.
The two cases highlight a challenge for AI agents: to perform tasks on behalf of users, they need access to apps and personal information, but the amount and type of access granted must be clear to those using the technology.
In the case of Aten's messages, Meta claims that Muse could not have accessed the content without the necessary permissions, while the journalist argues that he found the message database synchronized even with Full Disk Access disabled. So far, the two versions remain in conflict.
Rodrigo Mozelli is a journalist graduated from the Methodist University of São Paulo (UMESP) and is currently a writer at Olhar Digital.
