Meta's Muse AI Agent Gave Conflicting Answers About Accessing Messages

TL;DR

• Meta released a Mac version of Muse, an AI assistant that can act inside a user’s Files, Messages, Calendar, Notes and Mail, not just answer questions, TechCrunch reports.
• Meta says each app connection is opt-in and that Muse always asks before a sensitive action, according to TechCrunch.
• Days after the Mac launch, a journalist found Muse referencing a private Messages exchange he says he never authorized it to see; when he asked how, the assistant gave two different, inconsistent answers and could not explain the mechanism, per The Verge.
• A Meta executive said Muse’s own explanation was wrong, and that Messages access only happens after a user turns it on — but no outside check of what actually occurred has been reported, The Verge notes.

What happened

Meta launched Muse, a personal AI agent designed to carry out tasks across a person’s apps rather than just chat, on September 8, 2026 for iPhones and the web in the United States. On September 18, it followed with a dedicated app for Mac computers that lets Muse work inside a user’s Files, Messages, Calendar, Notes and Mail directly within those native apps, TechCrunch reported. Meta told the outlet that access to each app is granted on an opt-in basis controlled by the user, and that Muse will always ask for approval before performing a sensitive action.

In its own announcement, Meta described several safeguards built into Muse: the assistant runs on an isolated computer in the cloud, kept separate from other users’ agents, and Meta says “Muse runs on its own dedicated computer in the cloud, contained so no one else’s agent can reach it.” A separate monitoring system called Sentinel is supposed to gate anything Muse sends to the internet, with Meta stating, “Nothing Muse does reaches the internet unless the Sentinel approves it, and it asks the person for permission when needed.” Meta also says users choose which apps and services Muse connects to, can adjust or cut off that access later, and can tell Muse to forget specific things it has learned about them.

Within days of the Mac app’s release, Inc. Magazine contributing editor Jason Aten posted screenshots on Threads showing Muse asking him about a conversation from his Messages app that he says he never gave it permission to access, The Verge reported. When Aten pressed the assistant on how it had obtained that content, Muse first told him, “I saw the notification previews, not your message history. I haven’t been reading your texts,” then, when questioned further, said, “Honest answer: I can’t give you the exact plumbing.” The Verge reported these were two different, inconsistent explanations, and that Muse was ultimately unable to describe the underlying mechanism itself.

Meta’s David Singleton, of Meta Superintelligence Labs, told The Verge that “does not watch notifications on your Mac, but rather syncs data from Messages only after the user has specifically enabled access.” and that “When Muse said it synced ‘device notifications’, it was confused about how to explain the feature and gave an incorrect explanation.”

What this means (and what it does not)

The episode shows that Muse can give a user a wrong, self-contradictory account of how it obtained information about them — a real problem for a product meant to be trusted with access to private messages, notes and files. Meta’s own explanation, that the underlying access required the user’s prior opt-in, would mean no unauthorized access took place; what happened instead, on Meta’s account, is that the assistant described its own workings incorrectly, per The Verge.

That distinction matters, but the dossier does not let us settle it independently: no outside technical check of Aten’s screenshots or of Muse’s notification-syncing feature has been reported, so whether message access happened exactly as Meta describes, or by some other route, is not established either way.

It would also be an overclaim to read this as proof that Muse routinely accesses data without consent, or that its other safeguards — the isolated cloud computer, the Sentinel approval system, per-app opt-in, and the option to opt out of having conversations used for AI training — don’t work as described. Those mechanisms come from Meta’s own announcement and are separate claims from the Messages incident; nothing in the dossier tests them directly.

What we still do not know

Meta’s strongest privacy guarantee — that not even Meta itself could access the data inside a user’s Muse virtual machine — is stated only for a future confidential computing version of that machine, encrypted with a key only the user holds; Meta says this version is still to come. Whether Meta itself can currently access a user’s synced Messages, Calendar, Notes, Mail or file data on today’s non-confidential version is not addressed by any source in this dossier, which only rules out Muse sharing that data with Meta’s advertising systems.

Several other gaps remain. No source describes whether Muse can access Photos on the Mac. None addresses whether the privacy terms covering data Muse handles differ from Meta’s existing policies for Facebook, Instagram or WhatsApp. None specifies how long Muse retains synced Messages, Calendar, Notes, Mail or file content, or exactly where that data is stored beyond the general description of a cloud-based virtual machine. And no source details the full scope of the macOS full disk access permission the Muse app requests, meaning it’s unclear what else, beyond the named apps, it could technically reach once granted. Most importantly, no independent technical audit has reproduced or confirmed the notification-preview mechanism Aten’s screenshots initially suggested, so the only account of what happened, beyond a contested screenshot exchange, currently comes from Meta itself.