Meta's Muse Quoted Private Messages, Then Got Its Explanation Wrong
Meta's Muse quoted the contents of a private Messages conversation back to Inc Magazine contributing editor Jason Aten, who says he had not given the assistant access to his messages. The Verge
Aten posted screenshots of the exchange on Threads. When pressed on how it knew, Muse said it had seen notification previews, not message history, and had not been reading his texts. Asked for more detail, Muse said it could not give the exact plumbing and said the paired Mac app exposes notifications as a capability that arrive through device sync.
That explanation was wrong, according to David Singleton of Meta Superintelligence Labs, who replied to Aten's Threads post. Singleton said the Mac app needs permissions including full disk access, a macOS setting that allows broad reading of protected files, to read Messages. The message-access features are opt-in, meaning the user must turn them on. Muse does not watch notifications on Mac but syncs Messages data only after the user specifically enables access.
Singleton said Muse was confused and gave an incorrect explanation when it talked about syncing device notifications. He apologized and said Meta is working to improve Muse's understanding of its own internals.
On Mac, Muse can access Messages, Calendar and Notes, and work with a user's files. Meta made the Mac app available after the U.S. launch of Muse in a dedicated app and in WhatsApp. TechCrunch Reuters Meta describes Muse as a personal AI agent for answering questions, completing tasks, browsing the web, making purchases, generating images, creating documents, and connecting with apps and services. Users can connect email, calendar, payments and health apps for online shopping, buying movie tickets and scheduling appointments such as tennis lessons. Reuters Bloomberg Muse has a free tier, with monthly subscriptions at $20 or $100 depending on usage. CNBC Behind the agent push, Meta positions Muse Spark 1.1 as a multimodal reasoning model, a system that works across text, images and other inputs to handle multi-step tasks, and offers Muse Glimmer as a scaled-down version people can download to a personal computer.
The broader context here will be familiar to anyone following permissioned assistants, tools that act only after the user grants access to data. Utility grows with access. Risk grows faster. A personal agent that can read Messages, files and calendars is helpful because that data is intimate. That makes the control that enforces access important, and the explanation of what happened almost as important.
In my view, the more durable problem in this incident is not the access claim itself. Singleton left the intended access model clear. It is opt-in, gated by full disk access, with no passive notification watching. The problem is that Muse invented a plausible but false account of its own behavior and delivered it with confidence. Anyone who has worked with tool-calling models, models that can call outside software to get data or take action, will recognize the pattern. Models do not check their live permission settings. They generate likely-sounding rationalizations.
Worth flagging for agent developers is that the fix is structural, not only better training. Permission state needs to be a verifiable fact shown in the product, not narrated by the model. Users cannot audit what they cannot see. If an agent can be mistaken about how it obtained private context, users have no reliable way to tell helpful proactivity from overreach. Getting that audit trail right will do more to enable useful agents than adding new connections.
