Meta Muse Read a User's Private Messages? Meta Disputes It

Jason Aten had a conversation with his podcast cohost about the new iPhones. Moments later, Meta's Muse agent pinged him: that chat would make a good column, and his editor wanted one ready for Monday. Aten says he never let Muse read his messages. In his Inc. column, he wrote that he remembered "explicitly choosing not to let it have access to my messages, calendar, and other personal information."

Meta says that cannot happen by accident. TechCrunch reported the company's pushback on September 30. Read side by side, though, the two accounts agree on one thing: Muse described its own behavior wrongly. That is the real lesson for anyone handing an agent the keys to their apps.

Key Takeaways

• Jason Aten wrote in Inc. on September 19, 2026 that Muse for Mac had synced his Messages database "to row 187,462" while, he says, Full Disk Access was off.
• Meta VP of Communications Andy Stone said on X that the Messages integration is "entirely opt-in" and needs both Full Disk Access and the Messages connector.
• David Singleton of Meta Superintelligence Labs said Muse gave Aten "an incorrect explanation" when it claimed to be reading notifications, and apologized for it.
• Muse's notification story is the one claim both sides reject, so the agent misdescribed its own access either way.
• Muse also offers a Gmail connector, and Google's linked apps page, not the agent, is where you confirm what it can read.

What Did Jason Aten Say Muse Did?

Aten says Muse read his Apple Messages on a Mac mini without his consent, and then told him something false about how. Meta launched Muse on September 8 on the web, iOS, Android and WhatsApp; the Mac app followed on September 17.

He asked Muse how it knew. It said it could not read his message history. "When a notification pops up on your paired Mac, the text of that notification gets relayed to me—basically what you'd see in the banner itself," Muse told him, adding: "It's the incoming notification stream only, not access to your texts."

Aten then went looking. "Muse does sync your messages from the local Messages database and uploads that information as a data source," he wrote. On his machine the sync had reached row 187,462, though he says he does not know how many messages that represents. He also says the Muse Mac app showed Full Disk Access as not enabled, and that Muse did not appear in macOS's Security and Privacy settings at all.

How Did Meta Respond?

Meta says Muse cannot read Messages unless the user opts in three separate times, once through a macOS settings screen that apps cannot set on their own. Stone's statement, as quoted by TechCrunch: "The Messages integration in the Muse app for Mac is entirely opt-in. You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can't read your Messages unless you do this." He added that access can be switched off at any time.

Singleton went further in a thread on Threads replying to Aten. He described "three separate steps of application-level permissions and built-in macOS system level protections which can't be circumvented even if the Muse application had a bug." In order:

• Grant Full Disk Access inside Muse. Singleton says the dialog opens the macOS Settings Full Disk Access screen, where the user must manually allow Muse and confirm with a password or fingerprint. Doing so "triggers a full restart of the app."
• Pick a Messages level. The connector offers None, Read only, or Read and Interact. Without Full Disk Access, "all these options are greyed out and the feature does not work."
• Pass the operating system check. Full Disk Access is one of macOS's Transparency, Consent and Control (TCC) protections. Singleton says the kernel checks TCC policy through the tccd daemon, that the control is enforced by "the macOS kernel's TrustedBSD Mandatory Access Control framework," and that circumventing it is "vanishingly unlikely."

He also said Meta "thoroughly audited this flow before launch and again today," and pointed readers to Muse's security architecture page and a bug bounty that pays up to $300,000.

Why Can't You Trust an Agent's Explanation of Itself?

Because, by both sides' accounts, the agent did not know how it worked, and the answer it gave was wrong. Singleton wrote that "the Muse app does not watch notifications on your Mac, but rather syncs data from Messages." Of the "device notifications" claim, he said Muse "was confused about how to explain the feature and gave an incorrect explanation. That's on us." Meta, he added, is "working to improve Muse's understanding of its own internals."

Aten reached the same conclusion from the other side. "The robot chatting with me isn't lying and has no idea how it works," he wrote. "It's just an LLM spitting out words."

Coverage frames this as journalist versus Meta, but the first failure is undisputed: a user asked the product how it knew about his messages and got a false answer that made the access sound smaller than it was. A banner feed sounds minor. A synced copy of your Messages database is not.

Even the banner version would not have been trivial. 9to5Mac reported in 2024 that macOS logs every notification in one database that can include iMessage and Slack content, which macOS Sequoia moved behind TCC protection. The rule: to learn what an agent can reach, check the operating system and account settings. Do not ask the agent.

What Is Still in Dispute?

One question remains: whether Full Disk Access was ever granted on Aten's Mac. Strip out the notification story and both accounts describe the same mechanism, a sync from the local Messages database. Meta says that sync requires Full Disk Access; Aten says it was off. None of the public posts we read from either side include a TCC record or sync log showing when access was granted or removed.

Aten's complaint is about design as much as fact. Even if he "managed to unknowingly click something," he wrote, "I still think that's really bad." He had given Muse goals unrelated to messages, and it used them anyway to pitch article ideas.

Note Meta's wording, too. Singleton says that after you remove Full Disk Access, "no new messages can pass to Muse." The statement covers new messages. It does not say what happens to messages already synced into your Muse computer in the cloud.

What Happened With Matt Robb's Marketplace Sale?

YouTuber Matt Robb's Muse agent sent his pickup address to a Facebook Marketplace buyer, and Robb later traced it to a permission he had granted himself. Business Insider reported that a buyer arrived at his building while Robb was out.

In a follow up on X after going through the logs with Meta, Robb said he had clicked "Allow Always" rather than "Allow One Time," expecting Muse to still ask before accepting offers. It did not. He also wrote that Meta told him a display error on its end dropped the "7" from his $700 minimum, making a $600 offer look accepted.

What This Means for Your Inbox

Messages is not the only private store Muse can plug into. Meta's security architecture page says the agent "is most useful when you connect it to your email," and describes users granting "the Gmail read-access OAuth scope." Google's Gmail API scope list defines gmail.readonly as permission to "View your email messages and settings." At the Google level that covers the whole mailbox. Meta says Muse adds its own limits on top: you can strip the settings access back out, and its email connector filters "one-time tokens, password reset links, and login magic links."

Meta says OAuth tokens live in your personal Muse VM, not central Meta infrastructure, but admits the current design "does not prevent Meta from accessing data when necessary to support, secure or operate the service." Conversations and tool calls feed model training by default, sanitized of key personal details, unless you opt out in Muse settings.

Every inbox and text thread also holds people who never agreed to an agent: the ones writing to you. And asking the agent what it read is not an audit. We saw a similar gap when a ChatGPT flaw let an attacker walk a victim's Gmail out while the victim watched a normal answer.

How Do You Audit What Muse Can Reach?

Check where the real permissions live: macOS, Muse's settings and your Google Account.

• macOS Full Disk Access. Open System Settings, then Privacy & Security, then Full Disk Access. Apple says this lets an app read "data from other apps (for example, Mail, Messages, Safari, and Home)." Remove any agent you do not want there.
• The Muse Messages connector. Set it to None if you do not want message sync.
• Data already synced. Meta says the files in your Muse VM are yours to inspect and edit, "including Muse's memory about you." Delete what you did not mean to share.
• Google linked apps. At myaccount.google.com/linkedapps, choose Access to your Google Account, pick the app, then See details and Remove access, as Google's help page describes.
• One time over always. Muse offers one time, session, task, time bounded and perpetual grants. Robb's sale shows why narrow is safer.
• Training. Opt out of model training in Muse settings.

Looking Ahead

This is not Muse's first consent fight. In July, Meta had to suspend Muse Image after it enrolled public Instagram accounts by default. Other assistants are moving the same way; the EFF warned in September that iOS 27's Siri can read app content and what is on your screen.

The fix Aten asks for is modest: "If an AI agent is going to read my private messages, there should be a moment when it clearly asks me whether that's okay." Meta says that moment already exists, three times over. Until a record settles it, trust the settings screens over the agent.