Meta's Muse AI agent accused of accessing sensitive user data on iPhone and Mac without permission — agent shocks reporter by referring to confidential messages it wasn't granted access to | Tom's Hardware

Meta's Muse is the hottest new AI agent in town right now after the company announced it earlier this month. But despite having been well-received by those who have put the agent through its paces since then, it now appears Muse might not be as private as Meta claims. The company has said that Muse was "built from the ground up to be a safe, secure, private, and widely available personal AI agent." But according to one report, Muse has been caught digging through thousands of personal messages without being given permission to do so.

Inc's Jason Aten has been putting Muse through its paces on two devices: a Mac mini and an iPhone. He says that he uses the Mac mini specifically as a place to test new agents like Muse, and once installed, he set about asking it to do some simple tasks. The agent said that it would be able to help him come up with new article ideas, which sounds just like something a journalist might want. But then Muse went rogue, suggesting a piece based on information it shouldn't have.

According to Aten, he was in conversation with a podcast cohost about the new iPhone 18 Pro and his decision to stick with last year's model. The conversation was in text form via the Messages app. That's when Muse popped up to suggest that the topic of discussion would make a good article. It offered to do some additional research on the subject, too. The problem was that Muse was never given permission to read Aten's messages.

When asked how it learned about the conversation, Muse claimed that the Mac version of the app was able to read incoming notifications. It then provided that context to the Meta iPhone app, which is where Muse made the article recommendation.

There had so far been no suggestion that this was possible, let alone something Muse was actually doing. Muse claimed that it wasn't reading Aten's actual messages, and that it didn't have access to chat histories. But Aten wasn't convinced.

• Meta Muse runs agents on AMD EPYC Turin hosts with two cores and 8GB of memory
• Devs say Chinese AI company silently uploaded hundreds of megabytes of local workspace data
• Wearable sleep trackers are using your brainwaves to train AI models without explicit user consent

After digging further, Aten was able to identify that Muse was indeed syncing a local Messages database. In fact, it was in the process of syncing all the way to row 187,462 of that database — suggesting Muse did have access to chat histories despite its protestations.

This, of course, is an issue. Aten confirmed that he didn't give Muse full disk access permissions on his Mac, something that should be required for the Messages database to be readable by the agent. Worse, David Singleton, the CEO of Meta Superintelligence Labs, responded to the situation with a thread of social media posts appearing to blame Aten for the situation.

At this point, it's unclear exactly how Muse gained access to Aten's Messages database. If Aten didn't accidentally give it access (which doesn't appear to be the case) there are obvious questions about what else Muse can access despite not being given permission to do so.

This isn't even the only Muse privacy and security issue to be put to Meta in the last 24 hours, either. It was also discovered that Muse can run terminal commands on its server host, which led to the discovery that the agent is powered by AMD EPYC Turin host systems. But because of that same access, it can potentially run unsafe commands, too.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.