Meta Denies Muse AI Read Private Messages Without Permission
Meta is disputing a journalist’s claim that its Mac AI agent Muse read private messages without permission, saying the Messages integration is opt-in and requires Full Disk Access and a Messages connector. The denial follows a detailed reporter account and technical pushback from Meta executives.
The claim came from Inc. columnist Jason Aten. Meta VP of Communications Andy Stone responded on X, saying, “The Messages integration in the Muse app for Mac is entirely opt-in.” He added: “You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can’t read your Messages unless you do this.”
The denial has not settled the matter for many people. Meta has faced years of criticism, lawsuits, FTC violations and fines over its handling of consumer data. Days before the dispute, a New Mexico jury determined the company had misled users about its data practices in a case that resulted from the 2018 Cambridge Analytica data breach scandal.
Stone’s statement followed a more technical reply from David Singleton, an executive at Meta Superintelligence Labs, who responded to Aten on Threads. Singleton said the permissions a user must grant to let Muse read messages on a Mac involve “three separate steps of application-level permissions and built-in macOS system-level protections,” which “can’t be circumvented even if the Muse application had a bug.”
According to Singleton, a user must explicitly grant Muse Full Disk Access, then choose what level of access Muse has to the Messages app: None, Read only, or Read. If Full Disk Access is not enabled, those options are grayed out. Granting Full Disk Access also invokes the macOS Settings user interface, where the user must manually confirm the action. Singleton said doing so triggers a full restart of the Muse app, making an accidental choice without the user’s knowledge less likely.
Aten’s report said that when Muse read his messages, Full Disk Access was off. He also said that when he asked Muse to explain how this occurred, the AI said it was syncing his “device notifications.” Aten believes Muse was passing along the text of his incoming banner notifications on the Mac to the AI agent.
Singleton disputed that account as well, saying the AI was confused and gave an incorrect explanation of what happened. He pointed to Meta’s page about Muse’s security architecture and bug bounty process. In effect, Meta’s response is that what Aten said happened did not and could not have happened.
Muse has faced another allegation. YouTuber Matt Robb recently said Muse mishandled a task in which he was selling things on Facebook Marketplace, leading to his address being shared and a buyer showing up when he was not home. Singleton is apparently looking into that incident, according to his response on Threads, suggesting the company believes this one, at least, could be its fault.
TechCrunch reported that Muse’s app remains No. 1 on the App Store, but that whether users can trust the agent will be a deciding factor in whether Meta wins the consumer AI market. TechCrunch also wrote that the company should engage with the journalist directly to determine how this could have happened instead of only denying that it did.