Meta disputes claim that Muse read a user’s private messages without permission

Stone’s official statement from Meta follows a more technical reply from Meta Superintelligence Labs executive David Singleton, who responded directly to Aten on Threads, explaining that the set of permissions a user must grant to let Muse read their messages on the Mac involves “three separate steps of application-level permissions and built-in macOS system-level protections.” He said these “can’t be circumvented even if the Muse application had a bug.”

The steps involve explicitly choosing to grant Muse Full Disk Access, which would then allow the user to choose what level of access Muse is being granted to the Messages app (i.e., None, Read only, or Read). If Full Disk Access is not enabled, these options are grayed out.

In addition, when allowing Full Disk Access, the dialog invokes the macOS Settings user interface, where the user has to again manually confirm that they intend to take this action. Doing this triggers a full restart of the Muse app, Singleton wrote, which makes it even less likely that such a choice could be made accidentally without the user’s knowledge.

However, Aten’s report claimed that when Muse read his messages, Full Disk Access was off. He also said that when he asked Muse to explain how this occurred, the AI said that it was syncing his “device notifications.” That means, Aten believes, that Muse was passing along the text of his incoming banner notifications on the Mac to the AI agent.

Singleton disputed this, too, saying that the AI was confused and gave an incorrect explanation of what happened. He then pointed to Meta’s page about Muse’s security architecture and bug bounty process.

In short, the company’s response is essentially that what Aten said happened did not and could not have happened.

This is not the only incident where Muse has allegedly overstepped and won’t likely be the last. Another user, YouTuber Matt Robb, recently said that Muse mishandled a task in which he was selling things on Facebook Marketplace, leading to his address being shared and a buyer showing up when he wasn’t even home. Singleton is apparently looking into that one, per his response on Threads, suggesting that the company believes this one, at least, could be its fault.