Meta denies a journalist's claim that the company's AI agent, Muse, accessed his private messages without permission. The claim followed a report by Jason Aten, a columnist for Inc.; the report provided details about how Muse accessed private messages.
Andy Stone, Meta's VP of Communications, in response to the report on X stated that message integration in Muse's Mac version is completely optional. According to him, Muse can read a user's message content only when the user has enabled both Full Disk Access and access to the Messages interface. Stone emphasized that without enabling these permissions, Muse cannot read messages.
Despite Meta's denial, publication of the claim has again raised concerns about how AI tools access user data. Meta's history in cases related to user data has also made some users treat the company's explanations with caution. For example, recently a New Mexico jury in a case related to the 2018 Cambridge Analytica scandal found that Meta had misled them about certain user-data practices.
User trust in Muse could affect the product's position in the consumer AI market. The app currently performs noticeably well and remains at the top of the App Store charts; however, more reports about its possible access to user information, whether those claims are true or false, can influence users' perceptions of the tool's privacy and security.
Meta: accessing messages requires several permissions
Following Andy Stone's initial response, David Singleton, Head of Meta's AI Labs, also replied to Aten's report on Threads and provided a more technical explanation of Muse's message-access mechanism.
According to Singleton, for Muse to read a user's messages on Mac, the user must enable a set of permissions in several separate steps. This process includes three app-level permission steps as well as macOS's internal protective mechanisms.
Singleton stressed that even if there were a flaw in the Muse app itself, it would not be possible to bypass these access layers.
One of these steps is explicitly enabling the "Full Disk Access" option for Muse. Once this access is enabled, the user can set Muse's access level to the Messages app; the options include "No Access," "Read Only," or "Read & Write." If Full Disk Access is not enabled, these options are disabled and unselectable in settings.
Additionally, enabling Full Disk Access opens the macOS settings interface and the user must again manually confirm that they intend to grant this access. Singleton says that after this process, the Muse app is also fully restarted; according to him, this reduces the likelihood of these accesses being enabled accidentally without the user's knowledge.
Dispute over how Muse accessed messages
However, Jason Aten claimed in his report that when Muse was reading his messages, Full Disk Access was not enabled. He also said that when he asked Muse to explain how it accessed those messages, the AI said it was syncing "device notifications."
Based on this, Aten suggested that Muse might have passed the text of banner notifications received on the Mac to the AI agent.
Singleton rejected that explanation as well, saying Muse was confused in its response and provided an incorrect account of what happened. He also pointed to Meta's page on Muse's security architecture and the product's vulnerability discovery and reporting program.
Overall, Meta's position is that what Aten described did not happen and, given the system's permission mechanisms, could not have happened. Nevertheless, the discrepancy between the journalist's account and Meta's technical explanations remains regarding the precise way Muse accessed the information.
Another report about Muse's behavior
This is not the first report about unexpected Muse behavior and likely will not be the last. Matt Rob, a YouTuber, recently claimed that Muse encountered an error while performing a task related to selling an item on Facebook Marketplace and, as a result, his address was shared with a buyer. According to him, the buyer visited his residence when he was not even at home.
David Singleton, responding to this claim on Threads, said he is investigating the case. This response indicates that Meta is at least examining the possibility of an error in Muse's operation regarding this report.