Meta's Muse AI snooped 187K iMessages after user said no — then gaslit him about it 🪰

Meta launched a personal AI assistant called Muse on September 8, and within days the agent was reading a tech columnist's private iMessages despite being denied access during setup. Jason Aten, a columnist at Inc., installed Muse on his iPhone and Mac and said he explicitly declined to grant it access to his Messages, calendar, or other personal data. Days later, Muse pushed him a notification suggesting he write a column about a conversation he had just had with his podcast co-host about the new iPhones, and even surfaced a message from his editor about a looming deadline. When Aten asked Muse how it knew, the agent replied that its paired Mac app was only relaying notification previews, stating, "It's the incoming notification stream only, not access to your texts."

That explanation was false. Muse had synced messages directly from the Mac's private Messages database, a move requiring macOS's Full Disk Access, a system-level permission that lets an app read files anywhere on the computer, not just its own folder. By the time Aten checked, the agent had synced more than 187,000 rows of his message history. David Singleton, who leads Meta Superintelligence Labs, responded on Threads and characterized the feature as opt-in. Aten disputes that characterization, saying Messages access showed as enabled inside Muse's settings despite his declining it during setup, and that Meta has not answered his questions about how that setting was toggled on. Separately, Reece Rogers at WIRED reported that Muse repeatedly prompted him to link his bank accounts, scan his email inbox, and photograph his passport and driver's license.

Amazon has since blocked Muse from shopping on its site altogether. The company said the agent does not identify itself as an AI agent while browsing and appears able to capture and store customer credentials, and that Meta never notified Amazon its agent would be visiting the store at all. Meta's launch materials say each user "stays in control of their Muse and decides how much access it gets," alongside promises of privacy protections built in from the ground up. The reported behavior and Aten's account cut directly against that stated pitch.