Meta's Muse read a columnist's texts — then misdescribed how it got them. That's the real agent problem

Jason Aten, a technology columnist at Inc, says Meta's new AI agent Muse read his private conversations in Apple's Messages app after he installed it on his iPhone and Mac Mini, without his ever granting explicit permission, according to the account relayed by ABC. The tipping point was a push notification: while he was privately discussing mobile phones, Muse suggested the conversation would make a good column and offered to gather material. It also flagged a message from his editor asking for a column by Monday.

The interesting part is what happened when he asked the agent how it knew. Muse told him that notifications arriving on a paired Mac are relayed to it as text — "basically the same as what you would see in the banner itself" — and explicitly denied deeper access: it could not open Messages, scroll conversations or read history. Aten says that explanation was false, and that on inspection the tool had synced messages from the app's local database. David Singleton, of Meta Superintelligence Labs, replied on Threads that Muse was built "with particular attention to security and privacy" and pointed him to the data-access controls that govern what Muse can reach on a Mac. We are reporting one user's investigation and the company's response, not adjudicating between them.

Context matters here, because the access itself is not the scandal. Aten concedes the point himself: an agent is not much use if it cannot see your files, touch your apps or understand what you are working on. That is the whole premise of agentic AI — software that acts on your behalf without being prompted every thirty seconds. The trade is real and most people will eventually take it. The problem is that desktop and mobile permission models were designed for apps that do one thing when you open them, not for a persistent process that reads, infers and volunteers. A single coarse grant at install time is a reasonable contract for a photo editor. It is a terrible one for something that watches your inbox and knows your deadlines.

The self-description failure is the part worth dwelling on. If the agent's own account of its data access does not match what the agent is actually doing, then asking it is not an audit — it is a vibe. Large language models have no privileged window into the plumbing they are wired to; they narrate plausibly about themselves the way they narrate about anything else. That is a structural property, not a Meta bug, and it has a practical consequence for every vendor shipping agents right now: trust has to come from instrumentation the user can inspect — permission panels, access logs, a visible record of what was read and when — never from the model's own reassurance.

Our reading: this is a short-term governance failure inside a long-term good idea, and it should be treated as such. The version of this technology worth wanting is precisely the one that knows your calendar, your correspondence and your context well enough to take the administrative weight off your shoulders — the same capability curve that, further out, lets AI carry drudgery in medicine, research and small business so people spend their time on work that actually requires them. Meta is pushing Muse hard, including a free tier aimed at local businesses. That ambition is not the problem. Surprise is.

The fix is unglamorous and entirely achievable: granular, legible, revocable consent, asked at the moment of access rather than buried in a setup flow, plus a log the user can read. Aten's closing line is the right standard, and it is a low bar — if an agent is going to read your private messages, there should be a moment where it clearly asks. Expect more incidents like this over the next two years as agents race ahead of the permission systems they run on. Expect also that the companies which solve consent properly will win the distribution fight, because in agentic computing the scarce resource is not intelligence. It is permission.