Did Meta's Muse AI Agent Read a Journalist's Texts? What We Know

In late September 2026, a story about Meta's new AI agent, Muse, turned into one of the biggest AI privacy arguments of the year. A tech columnist said the agent knew what was in his private text messages. Meta said that was impossible without his permission. Within days, Apple announced changes to the macOS permission at the centre of it all.

Here's what each side has said, what's still unresolved, and the practical lesson for anyone running an AI agent on their computer.

The claim

Jason Aten, a columnist for Inc., wrote in a 19 September column that he had installed Muse on his iPhone and Mac. According to Mashable's summary and the excerpt quoted by Daring Fireball, Muse later sent him a push notification suggesting that a text conversation with his podcast co-host, Stephen Robles, about the new iPhones would make a good column. It also flagged a message from his editor about a deadline.

"I never gave it permission to read my messages," Aten wrote, adding that he remembered explicitly declining access to his messages, calendar and other personal information during setup.

When he asked Muse how it knew, the agent said the Mac app was passing along incoming notification banners. Aten said his own digging suggested something different: that Muse had synced his local Messages database, reaching row 187,462. As Mashable notes, a row number isn't necessarily a count of messages, but it points to more than just notifications. Aten also said Muse's settings showed Full Disk Access as disabled.

Meta's response

Meta pushed back hard. Meta VP of Communications Andy Stone wrote on X, as reported by TechCrunch: "The Messages integration in the Muse app for Mac is entirely opt-in. You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can't read your Messages unless you do this."

Meta Superintelligence Labs executive David Singleton gave a more technical reply on Threads. He described "three separate steps of application-level permissions and built-in macOS system-level protections" that "can't be circumvented even if the Muse application had a bug." According to TechCrunch, the Messages options in Muse are greyed out unless Full Disk Access is granted, granting it means confirming in macOS System Settings, and that triggers a restart of the app. Singleton also said Muse's own explanation about notification banners was simply wrong: the AI was confused about what had happened.

Where it stands

As of this writing, it's a genuine he-said, they-said. Aten describes what he saw; Meta says the permission design makes it impossible without consent. Nobody outside the two parties has published a full forensic explanation, so be wary of anyone who sounds certain either way.

Two things are clear, though. First, Meta's own explanation confirms that once Full Disk Access is on, the gate is a setting inside the app. Ars Technica quoted macOS security researcher Patrick Wardle making exactly this point: with FDA, almost any non-root file is readable, including browsing history, cookies and chats. Second, on 2 October Apple announced that it will add controls so that apps get this "extraordinary level of access" only with "very explicit user action", citing the growing risks from AI agents. I've covered that in Apple Is Tightening macOS Full Disk Access Because of AI Agents.

Another lesson is easy to miss: don't trust an AI agent's explanation of its own behaviour. Both sides agree Muse gave an account of what it had done that didn't match reality. Agents generate plausible answers; they don't necessarily have accurate insight into their own plumbing. Logs and permission settings are evidence. The chatbot's answer isn't.

What to check on your own Mac

On a Mac, the Messages history lives in a database inside your user Library, and macOS protects it so that ordinary apps can't read it. Full Disk Access is the key that unlocks it. So:

1. Open System Settings > Privacy & Security > Full Disk Access and look for any AI agent, assistant or "copilot" app. If you don't actively need it to read everything, switch it off.
2. Inside each agent, review its connectors (Messages, Mail, Calendar, Files). Turn off any you didn't deliberately choose.
3. Check Notifications too. Even without FDA, notification previews can contain message text, so think about which apps get to see them.
4. If you want to try a new agent, do what Daring Fireball's John Gruber said he would: try it on a machine that doesn't hold most of your data. A separate macOS user account is a lighter-weight version of the same idea.

The same logic applies to servers. On a NAS or Linux box, give automation its own low-privilege account and never your admin account. My Synology SSH hardening guide explains why every SSH user on DSM is effectively an administrator.

Watch the short version

This story is covered on Riff's AI Headlines, a YouTube channel with quick, sourced AI and cybersecurity news. Subscribe to Riff's AI Headlines on YouTube to keep up.