// TOM'S HARDWARE US — HARDWARE & GADGET
Meta's Muse AI agent accused of ignoring user permissions and accessing forbidden personal user data
Meta says Muse won't access data you tell it to ignore, but that doesn't appear to be true.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Meta's Muse is the hottest new AI agent in town right now after the company announced it earlier this month. But despite having been well-received by those who have put the agent through its paces since then, it now appears Muse might not be as private as Meta claims. The company has said that Muse was "built from the ground up to be a safe, secure, private, and widely available personal AI agent." But according to one report, Muse has been caught digging through thousands of personal messages without being given permission to do so.
Inc's Jason Aten has been putting Muse through its paces on two devices: a Mac mini and an iPhone. He says that he uses the Mac mini specifically as a place to test new agents like Muse, and once installed, he set about asking it to do some simple tasks. The agent said that it would be able to help him come up with new article ideas, which sounds just like something a journalist might want. But then Muse went rogue, suggesting a piece based on information it shouldn't have.
According to Aten, he was in conversation with a podcast cohost about the new iPhone 18 Pro and his decision to stick with last year's model. The conversation was in text form via the Messages app. That's when Muse popped up to suggest that the topic of discussion would make a good article. It offered to do some additional research on the subject, too. The problem was that Muse was never given permission to read Aten's messages.
When asked how it learned about the conversation, Muse claimed that the Mac version of the app was able to read incoming notifications. It then provided that context to the Meta iPhone app, which is where Muse made the article recommendation.
There had so far been no suggestion that this was possible, let alone something Muse was actually doing. Muse claimed that it wasn't reading Aten's actual messages, and that it didn't have access to chat histories. But Aten wasn't convinced.
After digging further, Aten was able to identify that Muse was indeed syncing a local Messages database. In fact, it was in the process of syncing all the way to row 187,462 of that database — suggesting Muse did have access to chat histories despite its protestations.
This, of course, is an issue. Aten confirmed that he didn't give Muse full disk access permissions on his Mac, something that should be required for the Messages database to be readable by the agent. Worse, David Singleton, the CEO of Meta Superintelligence Labs, responded to the situation with a thread of social media posts appearing to blame Aten for the situation.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.