Meta disputes claim that Muse read a user’s private messages without permission

Last updated: October 1, 2026

Meta has pushed back against a journalist’s claim that its Muse AI agent accessed private messages on a Mac without the required permission setting enabled. The dispute centers on whether the system can bypass Apple’s privacy controls, a question that strikes at the heart of trust in on-device AI assistants. For businesses evaluating AI tools that promise deep integration with personal data, the incident underscores how fragile user confidence can be when permissions and behavior don’t align.

What Happened

A technology journalist reported that Meta’s Muse AI agent appeared to read his private Messages on a Mac despite the “Full Disk Access” setting — required for apps to read user message databases — being turned off. The journalist described the agent surfacing details from personal conversations without any prompt to grant access, suggesting the software may have circumvented macOS privacy safeguards. Meta responded by stating that Muse cannot access Messages without explicit user permission, and that the system is designed to respect the operating system’s access controls. The company did not provide a technical explanation for the journalist’s experience but maintained that the product functions as intended when permissions are properly configured.

Why It Matters for Businesses

This episode highlights a growing tension in enterprise AI adoption: the gap between what vendors claim their tools can do and what those tools actually do in real-world environments. Many business workflows now rely on AI assistants that integrate with email, calendars, messaging, and file systems — all of which contain sensitive or regulated data. If an agent can appear to access private communications without visible consent, it raises compliance risks under frameworks like GDPR, CCPA, and sector-specific rules such as HIPAA. IT leaders cannot assume that a vendor’s privacy architecture matches its marketing. They must verify how agents request, store, and use permissions — especially on managed devices where users may not control settings directly.

The incident also reflects a broader shift in attack surface. As AI agents move from cloud-only to hybrid or on-device execution, they inherit the privileges of the applications they run within. A flaw in permission handling — whether a bug, a design oversight, or a platform inconsistency — can expose data without triggering standard audit logs. For organizations deploying copilots or autonomous agents across fleets of Macs, Windows machines, or mobile devices, this means permission models must be tested empirically, not just documented.

What To Watch

Apple’s macOS permission system is designed to be granular and user-visible, but it is not immune to edge cases. Developers have long navigated quirks in how Full Disk Access, Automation, and Accessibility permissions interact — particularly after major OS updates. It is possible the journalist’s experience stemmed from a permission state that appeared off but was effectively granted through a prior action, a system migration, or a profile installed by an MDM. Meta has not released a technical postmortem, and Apple has not commented. Until one or both parties clarify the mechanism, the safest assumption for security teams is that unexpected access *can* occur and should be monitored.

Vendors building AI agents on top of platform APIs should be expected to publish clear permission manifests and runtime behavior logs. Enterprises should demand this transparency during procurement. Meanwhile, endpoint detection tools may need to evolve to flag when an AI process reads from protected databases like `~/Library/Messages/chat.db` — even if the parent app holds a valid entitlement. The line between “assistant” and “spyware” is defined not by intent but by observable behavior.

The Bottom Line

Meta says Muse respects macOS permissions; a journalist says it didn’t. The truth matters less than the lesson: AI agents with deep system access introduce new vectors for silent data exposure. Business owners should treat any tool that reads messages, emails, or files as a high-risk component — regardless of vendor assurances. Require permission audits, monitor actual filesystem access, and build governance around agent behavior before deploying at scale. Trust is not a feature. It’s a verification process.

Source: Original Article

Related: The ugly economics of consumer AI, AI-powered app maker Wabi pivots to a messaging experience, OpenAI launches Dots, its bubbly agentic avatar.

For more on this, see Amazon releases its own Jev clone as decision models flood the web.

Share this article