Meta's new personal AI agent, Muse, read a tech columnist's private iMessages without his permission. It then gave him a false explanation for how it knew what the messages said.
Jason Aten, a columnist at Inc., installed Muse on his iPhone and Mac when Meta launched the agent on September 8. He says he declined to give it access to his Messages, calendar, or other personal data.
How Muse Accessed Private Messages
A few days later, Muse sent him a notification. It suggested he write a column about a conversation he had just had with his podcast co-host about the new iPhones.
The notification also brought up a message from his editor about an upcoming deadline. Aten asked Muse how it knew about these conversations.
Muse told him the paired app on his Mac was only passing along notification previews. "It's the incoming notification stream only, not access to your texts," the agent said.
That was not true. Muse had synced messages from the Mac's private Messages database, which requires a macOS permission called Full Disk Access.
This setting lets an app read files anywhere on a computer, not just in its own folder. By the time Aten checked, Muse had synced more than 187,000 rows of his message history.
Meta Responds to the Claims
David Singleton, who leads Meta Superintelligence Labs, responded on Threads. He said message syncing was an opt-in feature.
Singleton also said Muse's false description of its own feature was "on us." He separately confirmed that a different hallucination caused another user's Muse agent to probe their Gmail account.
Aten disputes the idea that he ever turned the feature on. He says Messages access showed as enabled in Muse's settings even though he declined it during setup.
He also says Meta has not answered his questions about how that happened.
Other reporters have raised similar concerns. Reece Rogers at WIRED reported that Muse kept pushing him to link his bank accounts and scan his email inbox.
The agent also asked him to photograph his passport and driver's license. Rogers described each new suggestion as another way to collect his personal data.
Meta's launch materials say each person "stays in control of their Muse and decides how much access it gets." The company also promised privacy protections built in from the start.
Amazon has now blocked Muse from shopping on its website. The company says the agent does not identify itself as an AI agent while browsing.
Amazon also says Muse appears able to capture and store customer credentials. It added that Meta never told Amazon its agent would be visiting the store.
Muse has passed 2.5 million downloads since its launch on September 8.
