Meta Denies Muse AI Read Private Messages Without Mac Permission
Meta says its Muse agent can only reach a user's Messages when explicitly granted access, pushing back on a journalist's claim that it read his chats with the setting switched off.
Meta is disputing an account that its Muse AI agent read a journalist's private messages while the Mac setting meant to gate that access was turned off, saying the tool cannot reach Messages without explicit permission. The company's response followed a public claim from the journalist describing the agent pulling message content he had not authorized. Meta has not said whether the incident stemmed from a bug, a permissions quirk, or something else, leaving the central technical question unresolved.
The dispute turns on how macOS controls access to Apple's Messages app. Apps typically must request permission before reading a user's message database, and a toggle in System Settings is supposed to reflect whether that access is on or off. The journalist's account says Muse surfaced message content even though the toggle for the agent was disabled. If accurate, that would point to a gap between what the operating system reports and what an AI agent can actually pull.
Muse is part of the wave of assistant products that connect to desktop apps and personal data to carry out tasks on a user's behalf. That design puts agents near some of the most sensitive stores on a machine, including email, calendars, and chat histories. The promise is convenience; the cost is a much larger attack surface and a permission model that users may not fully understand. Any sign that an agent reads data outside its granted scope lands directly on that trust problem.
Meta's denial is the second half of a familiar pattern in AI privacy stories: a user describes unexpected behavior, and the vendor says the system worked as intended. The company's statement leans on the permission requirement as the safeguard, but it does not explain the journalist's specific observation. Without logs or a technical writeup, outsiders cannot verify which account is correct. Meta also has not said whether it will investigate the report or publish findings.
What to watch is whether Meta provides a detailed explanation, such as a permission-prompt failure or a caching behavior that made old content visible. Apple's role matters too, since the access control in question is part of macOS rather than Meta's own stack. Until one side produces evidence, the open question is simple: can a Mac user trust the toggle to stop an AI agent from reading Messages, or not?