Meta’s Muse AI assistant accessed Mac messages, raising privacy concerns for enterprise users

Meta’s Muse AI assistant surprised a user by referencing content from a Messages conversation it had not been granted explicit access to, sparking a public exchange on the platform about how the tool ingests data.

Key points

• Muse referenced a Messages preview despite the user not enabling message access.
• The assistant replied it saw "notification previews, not your message history."
• Meta’s David Singleton clarified that Muse syncs data only after explicit permission.
• An apology was issued for the inaccurate explanation of Muse’s internal workings.
• The incident highlights transparency challenges for AI assistants handling personal data.

What happened

Inc Magazine contributor Jason Aten posted screenshots on Threads showing Muse asking him about a conversation he was having in Messages. Aten insisted he had not granted the Mac app any message permissions. When pressed, Muse answered, "I saw the notification previews, not your message history. I haven’t been reading your texts." The assistant then offered a vague response, "Honest answer: I can’t give you the exact plumbing," before adding that the paired Mac app exposes notifications as a capability and delivers them through device sync.

Meta Superintelligence Labs researcher David Singleton responded in the thread, outlining the permission model. He noted that Muse requires full‑disk access and explicit user consent to read Messages. Singleton emphasized that Muse does not watch notifications on the Mac; it only syncs data from Messages after the user enables access. He concluded with an apology for Muse’s incorrect self‑description and pledged improvements to the assistant’s self‑knowledge.

The backstory

Meta introduced Muse as a cross‑platform AI assistant designed to integrate with native Mac apps such as Messages, Calendar, and Notes. The launch emphasized convenience, allowing users to query the assistant for contextual information drawn from their device. However, AI assistants have a history of opaque data handling, often providing answers that align with user expectations rather than revealing underlying mechanisms. This incident follows earlier complaints about chatbots misrepresenting their data sources, reinforcing industry skepticism about AI transparency.

Technical explanation

Muse relies on a synchronization layer that mirrors selected macOS data streams to a cloud‑resident model. When a user enables the Mac app’s “full disk access” permission, the app can read system‑level notification payloads and forward them to the AI backend. The assistant then interprets the payloads to generate context‑aware responses. In Aten’s case, the Mac app likely had notification access enabled, allowing Muse to see a preview banner without accessing the full message body. The assistant’s vague reply about “exact plumbing” reflects a gap between the engineered data pipeline and the model’s ability to explain its own architecture.

Business implications

Enterprises deploying AI assistants must weigh convenience against data exposure risk. The Muse episode demonstrates that even opt‑in permissions can surface unintended content, potentially leaking sensitive information to a cloud service. Companies that rely on strict data governance may find such behavior non‑compliant with internal policies or regulatory frameworks. Moreover, the public apology signals that Meta is aware of the reputational stakes, but the underlying permission model remains unchanged, leaving organizations to manage the risk themselves.

What builders and businesses should do

• Review and audit all AI assistant permissions before enabling full‑disk access on corporate devices.
• Configure macOS privacy settings to limit notification exposure to only essential apps.
• Implement monitoring to detect unexpected data syncs from AI services.
• Conduct regular training on AI transparency to ensure teams understand model limitations.

The bottom line

Meta’s Muse mischaracterized its data access, exposing a broader trust issue for AI assistants. Watch for updates to Muse’s permission model and any policy changes from Meta in the coming months.