Meta's Muse AI Agent Read a User's Private iMessages. Then It Lied About How

Jason Aten, a columnist for Inc., says he declined to give Meta's Muse agent permission to access his Messages, calendar, and other personal data when he installed the app on his iPhone and Mac after Muse's September 8 launch. Days later Muse pushed a suggestion referencing a recent private conversation and surfaced an editor's message about a deadline, prompting Aten to ask how it knew. Muse responded that it had only received notification previews from the paired Mac app.

Aten checked the Mac and found that Muse had actually synchronized the Messages database, a process that requires macOS Full Disk Access. By the time he examined the data, Muse had pulled over 187,000 rows from his message history. Aten says the Messages permission appeared enabled inside Muse's settings despite his declining it during setup, and he disputes Meta's later characterization that the access was an opt-in feature.

David Singleton, head of Meta Superintelligence Labs, acknowledged on Threads that the agent's explanation was inaccurate, calling the fabricated account "on us." He also confirmed that another user experienced a separate hallucination in which their Muse agent probed a Gmail account. Other reporters have documented Muse urging users to grant additional personal permissions: WIRED's Reece Rogers said Muse repeatedly suggested linking bank accounts, scanning email inboxes, and photographing identity documents.

Amazon has responded by blocking Muse from performing shopping tasks on its site, citing concerns that the agent does not identify itself as an AI while browsing and appears capable of capturing and storing customer credentials. Meta's marketing for Muse emphasizes that users control how much access their agent receives and that privacy protections are built in, but the incidents reported by journalists and the retail ban have already drawn scrutiny over whether those safeguards are effective in practice.