Meta (NASDAQ: META) said on 30th September, 2026 that its Muse AI agent cannot read a Mac user’s Messages without deliberate opt-in, rejecting Inc. columnist Jason Aten’s claim that it read his private messages uninvited.
The Brief
- Jason Aten, an Inc. columnist, says Muse read his Messages while Full Disk Access was switched off on his Mac.
- Meta Vice President of Communications Andy Stone says Muse needs both Full Disk Access and the Messages connector to read Messages.
- Meta Superintelligence Labs executive David Singleton says access sits behind 3 separate steps of app and macOS protections that a Muse bug cannot bypass.
- Muse told Aten it was syncing his device notifications, an explanation Singleton calls confused and incorrect.
Meta says layered permissions block silent reads
Aten first described the episode in an Inc. column. Meta Vice President of Communications Andy Stone answered on X, writing that the Messages integration in the Muse app for Mac is “entirely opt-in.” Muse cannot read Messages content, Stone said, unless a user enables both Full Disk Access and the Messages connector.
David Singleton, a Meta Superintelligence Labs executive, replied to Aten directly on Threads with a more technical account. He described 3 separate steps of application permissions and built-in macOS protections, and said a bug in Muse could not circumvent them. A user first grants Full Disk Access, then chooses a Messages level listed as None, Read only or Read. Without Full Disk Access, those choices stay grayed out.
Granting Full Disk Access also opens the macOS Settings interface, where the user must confirm the choice a second time. That step triggers a full restart of Muse, Singleton wrote, which makes an accidental opt-in even less likely.
Meta says its Muse AI agent cannot access a user’s Messages without explicit permission, disputing a journalist’s account that the agent read his private messages while the required Mac setting was turned off.https://t.co/X6akvXTPy8
— TechCrunch (@TechCrunch) September 30, 2026
Aten’s account conflicts on Full Disk Access
Aten’s report says Full Disk Access was off when Muse read his Messages. After he asked Muse to explain, the agent said it was syncing his device notifications. Aten takes that to mean Muse received the text of incoming banner notifications on his Mac.
Singleton disputes that account too, saying the AI was confused and gave an incorrect explanation. He pointed to Muse’s security architecture page and its bug bounty process.
The dispute turns on which path carried the text. The permission steps Stone and Singleton described cover the Messages connector and Full Disk Access. Aten’s report points to Mac notifications, a path the quoted steps do not mention. If Aten is right, message text reached Muse by a route outside the Full Disk Access and connector steps.
Nothing quoted so far includes logs or captures from Aten’s Mac, which leaves four gaps:
- Which channel carried message text to Muse if Full Disk Access was off?
- Can notification sync expose message content to the agent?
- Has Meta examined Aten’s Mac or the Muse session logs?
- Why did Muse offer that explanation?
Mac users with Muse installed can check macOS Settings to see whether it holds Full Disk Access. They can also review the Messages access level set inside the app. Both checks help reduce risk while the dispute continues.
Another Muse complaint tests user trust
YouTuber Matt Robb said recently that Muse mishandled a task while he sold items on Facebook Marketplace. The mishap led to his address being shared, and a buyer showed up while he was away. Singleton’s Threads response indicates he is looking into the case. Robb’s case involves an agent handling a Marketplace task, while Aten’s involves access he says he never granted.
Days earlier, a New Mexico jury found that Meta misled users about its data practices. The case grew out of the 2018 Cambridge Analytica scandal. Meta also patched an Instagram AI support flaw earlier this year.
According to TechCrunch, Muse still ranks No. 1 on the App Store. Whether users trust Muse could decide how well Meta competes in consumer AI.
The public record now holds two incompatible accounts. Meta says no Muse bug could override its permission chain, while Aten says his Messages were read with Full Disk Access off. Logs from Aten’s Mac could show which account holds.
