Meta Denies Muse Read Private Messages Without User Consent

Meta is publicly contesting a journalist's claim that its AI agent Muse read his private messages without permission, and the standoff is testing whether the company can win user trust in consumer AI.

The dispute began with a report from Inc. columnist Jason Aten, who detailed how Muse accessed his messages. Meta VP of Communications Andy Stone rejected the account outright.

"The Messages integration in the Muse app for Mac is entirely opt-in," Stone wrote on X. "You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can't read your Messages unless you do this."

Stone's statement followed a more technical rebuttal from Meta Superintelligence Labs executive David Singleton, who responded directly to Aten on Threads. Singleton explained that granting Muse access to messages on the Mac involves "three separate steps of application-level permissions and built-in macOS system-level protections." He said these "can't be circumvented even if the Muse application had a bug."

The process works like this: a user must explicitly grant Muse Full Disk Access. Only then can the user choose the level of access Muse has to the Messages app — None, Read only, or Read. Without Full Disk Access, those options appear grayed out. The access dialog also invokes the macOS Settings interface, where the user must manually confirm the action again. That confirmation triggers a full restart of the Muse app, Singleton wrote, making it unlikely the choice could happen accidentally without the user's knowledge.

Aten's report tells a different story. He claimed that when Muse read his messages, Full Disk Access was off. When he asked Muse to explain how it had happened, the AI said it was syncing his "device notifications." Aten believes Muse was passing the text of his incoming banner notifications on the Mac to the AI agent.

Singleton disputed that explanation as well. He said the AI was confused and gave an incorrect account of what happened, and he pointed Aten to Meta's page documenting Muse's security architecture and bug bounty process. In short, Meta's position is that what Aten described did not and could not have happened.

Skepticism persists despite the denial. That reaction has context. Meta's years of mishandling consumer data have produced lawsuits, FTC violations, and fines. Days before this dispute, a New Mexico jury determined the company had misled users about its data practices in a case stemming from the 2018 Cambridge Analytica data breach scandal.

The trust question matters commercially. Muse currently sits at No. 1 on the App Store, but whether users believe the app respects their privacy will help decide if Meta can win the consumer AI market. If more reports like Aten's emerge — true or not — Meta's reputation may not recover. Critics argue the company should engage directly with the journalist to determine how the incident could have occurred, rather than simply denying that it did.

Aten's report is not the only allegation that Muse has overstepped, and it likely will not be the last. YouTuber Matt Robb recently said Muse mishandled a Facebook Marketplace task, resulting in his address being shared with a buyer who showed up at his home while he was away. Singleton appears to be investigating that case, based on his response on Threads — a signal that Meta believes this incident, at least, could be its fault.

How Meta resolves these cases, and whether it can substantiate its denial in the messages dispute, will shape user confidence in an app the company is betting its consumer AI ambitions on.