Meta is pushing back against a journalist's assertion that its AI agent Muse accessed private messages without the user's consent. The denial comes after an Inc. columnist, Jason Aten, published a report detailing the alleged incident. Andy Stone, Meta's VP of Communications, made it clear that the company does not believe its product behaved this way without user permission.

"The Messages integration in the Muse app for Mac is entirely opt-in," Stone stated on X, responding to the claims in the piece. "You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can't read your Messages unless you do this."

Even with Meta's denial, plenty of people remain doubtful that the company is telling the truth. Given the tech giant's long history of mishandling consumer data—resulting in lawsuits, FTC violations, and fines—this skepticism isn't exactly surprising. As recently as a few days ago, a New Mexico jury concluded that the company had misled users about its data practices in a case stemming from the 2018 Cambridge Analytica data breach scandal. Whether users can put their trust in Muse will ultimately determine whether Meta succeeds in the consumer AI market. While the app is currently performing well and still holds the No. 1 spot on the App Store, Meta's reputation might not bounce back if additional reports like this surface—whether they're accurate or not.

If anything, the company ought to be communicating directly with the journalist to figure out how this might have occurred, rather than simply denying that it did. Stone's official statement came on the heels of a more technical response from David Singleton, an executive at Meta Superintelligence Labs, who replied directly to Aten on Threads. Singleton explained that the permissions a user must grant to allow Muse to read their messages on the Mac involve "three separate steps of application-level permissions and built-in macOS system-level protections." According to him, these "can't be circumvented even if the Muse application had a bug."

The process requires explicitly choosing to grant Muse Full Disk Access, which then lets the user select what level of access Muse receives for the Messages app—None, Read only, or Read. Without Full Disk Access enabled, these options appear grayed out. Additionally, when granting Full Disk Access, the dialog brings up the macOS Settings user interface, where the user must manually confirm their intention once more. Singleton noted that doing this causes the Muse app to fully restart, making it even more improbable that such a choice could happen accidentally without the user knowing.

However, Aten's report claimed that Full Disk Access was off when Muse read his messages. He also said that when he asked Muse to explain what happened, the AI responded that it was syncing his "device notifications." According to Aten, this means Muse was forwarding the text of his incoming banner notifications on the Mac to the AI agent. Singleton disputed this as well, saying the AI was confused and provided an incorrect explanation of events. He then referenced Meta's page about Muse's security architecture and bug bounty process.

In essence, the company's position is that what Aten described neither happened nor could have happened. This isn't the only instance where Muse has allegedly overstepped, and it likely won't be the last. Another user, YouTuber Matt Robb, recently reported that Muse mishandled a task involving selling items on Facebook Marketplace, which resulted in his address being shared and a buyer showing up while he wasn't even home. Singleton appears to be investigating that incident, based on his Threads response, which suggests the company believes this particular case, at least, could be its fault.