Meta and a journalist disagree over whether the company’s Muse AI assistant read private Mac messages without permission. The journalist says he observed the assistant use information from Messages while Full Disk Access was off. Meta says the Messages connection requires explicit permissions and that Muse could not read the content in the circumstances described. TechCrunch reports the competing accounts, but does not independently establish which explanation is correct.
That uncertainty is the news. An AI assistant’s usefulness can depend on access to personal accounts and local files, yet users need to know exactly what they enabled. Here, the alleged behaviour and Meta’s technical response describe materially different versions of the same incident. Treating either as a proven finding would go further than the available report supports.
What the journalist alleges
TechCrunch recounts a report by Inc. columnist Jason Aten, who said Muse read his private messages even though Full Disk Access was disabled. When he asked the assistant how it had done so, Muse reportedly said it had been syncing device notifications. Aten believed the assistant might have been passing the text of incoming Mac notification banners to the AI agent.
That account raises two separate questions. One is whether Muse obtained message content without the permissions Meta says are required. The other is whether the assistant’s explanation of its own behaviour was reliable. The answer it gave Aten, as described by TechCrunch, is not itself a technical log or proof of a notification-based route. The report does not supply an independent reproduction of the incident or a forensic account of the data path.
TechCrunch says some observers remained suspicious despite Meta’s denial. Their reaction is not evidence that Muse accessed messages improperly. It does show why the precise sequence of permissions and the assistant’s explanation became central to the dispute.
Meta describes a multi-step consent process
Meta communications vice president Andy Stone said the Messages integration in Muse for Mac is opt-in. According to his response, a user must enable both Full Disk Access and the Messages connector before the app can read Messages content. He rejected the suggestion that the product did so without consent.
Meta Superintelligence Labs executive David Singleton gave TechCrunch a more detailed account. He said the user must explicitly grant Muse Full Disk Access, then choose the level of Messages access—none, read-only or read. Without Full Disk Access, he said, those choices are unavailable. The access request uses macOS Settings for another manual confirmation and restarts the Muse app after permission is granted.
Singleton argued that these application and operating-system protections could not be bypassed even by a Muse bug. He also disputed the assistant’s own notification explanation, saying the AI was confused and gave Aten an incorrect account. These are Meta’s technical claims. TechCrunch did not report an independent test confirming that the described controls operated exactly that way in Aten’s case.
The unresolved issue is not a proven breach
The account leaves a narrow but important gap: Aten says access occurred while a required permission was off, while Meta says the design makes that impossible. A product description can explain intended behaviour, but it does not by itself resolve what happened on one machine. Equally, a user’s observation does not on its own establish the mechanism by which an assistant received information.
TechCrunch also mentions a separate Muse incident involving a marketplace task and a user’s address. Its account says the user later acknowledged granting a permission that contributed to that outcome. That case should not be treated as confirmation of the Messages allegation; the tasks, permissions and reported consequences differ.
Meta has answered publicly with a specific consent sequence and a denial. The journalist’s contrary observation remains unverified in the TechCrunch report. Until the access path is independently established, the strongest supported conclusion is that the parties dispute both what Muse did and why its own explanation described a route Meta rejects.
