Meta is pushing back against a journalist’s claim that its AI agent, Muse, read his private messages without permission. The dispute centers on whether the Mac app can access Apple’s Messages data without a user explicitly granting it.
The back-and-forth began after Inc. columnist Jason Aten reported that Muse had read his messages even though Full Disk Access was turned off on his machine. Meta’s communications team has since argued that such access is impossible without clear, deliberate user consent.
What Meta says about Muse permissions
Meta VP of Communications Andy Stone responded publicly to the report, writing on X that the Messages integration in the Muse app for Mac is “entirely opt-in.”
“You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content,” Stone wrote. “It can’t read your Messages unless you do this.”
Meta Superintelligence Labs executive David Singleton added a more technical explanation, replying directly to Aten on Threads. According to Singleton, reading messages requires “three separate steps of application-level permissions and built-in macOS system-level protections” that “can’t be circumvented even if the Muse application had a bug.”
The process works like this:
The user must explicitly grant Muse Full Disk Access.
Only then can the user choose an access level for the Messages app — None, Read only, or Read.
If Full Disk Access is off, those options appear grayed out.
Granting Full Disk Access triggers the macOS Settings interface, where the user must confirm the action again.
The confirmation forces a full restart of the Muse app.
Singleton argued that this chain of confirmations makes an accidental permission grant highly unlikely.
Why the claim persists
Aten’s report stated that Full Disk Access was off when Muse read his messages. When he asked Muse to explain, the AI reportedly said it was syncing his “device notifications.” Aten interpreted this to mean Muse was passing along the text of incoming banner notifications on his Mac to the AI agent.
Singleton disputed that explanation as well, saying the AI was confused and gave an incorrect account of what happened. He pointed to Meta’s page on Muse’s security architecture and bug bounty process.
In short, Meta’s position is that what Aten described did not happen and could not have happened.
Trust remains the bigger question
Skepticism toward Meta’s denial is not hard to understand. The company has spent years dealing with fallout over how it handles consumer data, including lawsuits, FTC violations, and fines.
Just days before this dispute, a New Mexico jury determined that Meta had misled users about its data practices — a case tied to the 2018 Cambridge Analytica breach scandal. That history inevitably colors how people read any Meta statement about privacy.
Whether users trust Muse may ultimately decide whether Meta wins the consumer AI market. The app is performing well for now and remains No. 1 on the App Store, but repeated privacy reports — accurate or not — could damage its reputation in a way that is hard to reverse.
Muse’s other reported mishap
This is not the only incident where Muse has allegedly overstepped. YouTuber Matt Robb recently said Muse mishandled a task while he was selling items on Facebook Marketplace, leading to his address being shared and a buyer arriving when he was not home.
Singleton is reportedly looking into that case, according to his response on Threads — a sign that Meta believes this one, at least, could be its fault.
How the permissions actually work
Understanding the technical side helps clarify why the two accounts diverge. On macOS, Full Disk Access is a system-level switch that lets an app reach protected areas, including Messages. Without it, an app is meant to be blocked entirely from that data.
Meta’s explanation hinges on this gate. If Full Disk Access is off, the Messages connector options cannot be selected at all. If it is on, the user still has to pick an access level before Muse can read anything.
That is the strongest part of Meta’s defense. The weakest part is that the journalist says his setting was off, and the AI itself gave an explanation that Meta now calls wrong.
The takeaway
For now, Meta insists that Muse cannot read Mac Messages without explicit, multi-step user consent. The journalist at the center of the story maintains otherwise, and the AI’s own explanation contradicted Meta’s account. What is clear is that the dispute is less about one setting and more about whether users believe the company behind the agent.
Meta’s next move matters. Rather than simply denying the report, engaging directly with the journalist to determine how the situation could have occurred would do more to rebuild confidence than another statement. If more reports like this surface, the question of trust may follow Muse long after this particular claim fades.
