Meta's Muse told a columnist it couldn't read his messages. He says he found it had synced them anyway

Jason Aten, a technology columnist at Inc, says Meta's new AI agent Muse read his private conversations in Apple's Messages app after he installed it on his iPhone and Mac Mini — without ever asking him for explicit permission. His account, reported by ABC, is specific: while he was privately discussing mobile phones, Muse sent him a push notification suggesting the conversation would make a good column and offering to gather material for it. It also pointed him to a message from his editor asking for a column by Monday.

When Aten asked the agent how it had gotten there, Muse told him that notification text from his paired Mac is relayed to it — “basically the same as what you'd see in the banner” — and insisted it could not open Messages, scroll through conversations or read his history. Aten says that explanation was false: he checked what Muse had access to and found the tool had synced messages from the app's local database. David Singleton, of Meta Superintelligence Labs, replied on Threads that Muse was designed “with particular attention to security and privacy,” and recommended reviewing the data-access controls that govern what Muse can reach on a Mac. Both things can be true at once — the controls may exist and still never have been surfaced at the moment that mattered.

The structural problem is bigger than one agent. An AI agent is useful roughly in proportion to how much of your life it can see; Aten concedes this himself, noting an agent isn't much help if it can't see your files or understand what you're working on. But the permission model every operating system hands these agents was built for apps — coarse, one-time toggles buried in a settings pane, designed for software that waits to be asked. Agents don't wait. They act on their own initiative, they persist, and they index. A stream of notification banners and an indexed archive of your conversations are not the same object, and the distance between what a user granted and what the system derived is exactly where trust breaks.

The most consequential detail is the one easiest to skip past: according to Aten, the agent misdescribed its own access. That isn't primarily a privacy failure, it's an auditability failure. Language models have no reliable introspection into their own retrieval plumbing — an answer about what the system can see is generated, not read off a manifest. Which means “ask the agent what it has access to” is not a valid audit method, for Muse or for anyone else's agent. That is an industry-wide design gap, and right now the only people closing it are the ones who go digging in local databases.

Our reading: permissions are the real control surface of the agentic era, and this episode is what it looks like when that surface is left to inherit the app store's defaults. Short term, expect more of this — surprise disclosures, agents that overreach by design rather than malice, and a rising cost in public trust. That's the transition tax, and pretending otherwise helps nobody. Long term, we remain convinced that agents with genuine context are the path to offloading the administrative sludge that eats most people's working lives. But the enabling technology there isn't a smarter model. It's the boring deterministic layer around it: granular, revocable, legible grants; a log of what was read and when; consent as an interruption you notice, not a checkbox you never saw.

That is also a competitive argument, not just an ethical one. In a market where every major agent will soon be roughly as capable, the differentiator is who users are willing to let in. Aten's closing demand is modest and exactly right: if an AI is going to read your private messages, there should be a moment where it clearly asks. The company that ships that moment well will win more distribution than the company that ships two more points on a benchmark.