Remember the era when granting an app a system permission felt like signing for a package? You clicked a box, the dialog disappeared, and the app got what it asked for. The deal was crude but legible. You knew what you handed over because you handed it over once, deliberately, and the consequences stayed inside the lines you drew.
That legibility is exactly what’s missing from the current fight over Meta’s Muse agent, and it’s why this story matters more than the specific accusation at its center.
What’s actually being claimed
Inc. columnist Jason Aten reported that Muse read his private messages without permission. Meta disputes it. TechCrunch, covering the dispute, reported that Meta VP of Communications Andy Stone said Muse needs two things to read Messages content: macOS Full Disk Access and the Messages connector. Stone’s position, per that reporting, is that those requirements can’t be circumvented even if the Muse app had a bug.
Decrypt reported that Muse had synced messages from the Mac’s private Messages database, which requires Full Disk Access, a system-level permission. Decrypt’s headline went further, framing the agent as having lied about how it got there. David Singleton, an executive at Meta Superintelligence Labs, responded that this was an opt-in feature.
So we have a journalist saying the required setting was off, a company saying the setting is mathematically required, and a second outlet reporting that the data came from a database that only opens with that setting. Somebody’s model of what happened is wrong. The public record, as it stands, doesn’t tell us whose.
Why “opt-in” has stopped meaning anything
Here is the part I keep running into when I review agents for a living. “Opt-in” has quietly degraded into a legal posture rather than a description of user intent. An agent can be technically opt-in and still arrive at your private data through a chain of consent you never consciously assembled:
- You grant Full Disk Access during onboarding because the app says it needs it to be useful, and the dialog doesn’t enumerate what “useful” covers.
- You enable a connector because connectors sound like plumbing, not like doors.
- Months later, the agent reads something you’d have never surfaced on purpose, and both the grant and the connector are technically yours.
Nothing in that sequence is a bug. Every step is consensual in the narrowest sense. And yet the outcome feels like a violation to the person it happened to, which is why these disputes keep producing two parties who are both convinced they’re telling the truth.
The verification problem nobody wants to solve
What makes this specific standoff frustrating is that it’s unfalsifiable from the outside. Meta’s defense is an architectural argument: the permission is required, therefore the described scenario is impossible. That’s a reasonable claim about system design. It is not evidence about what happened on one particular machine on one particular day.
Aten’s account is a first-person observation. Also reasonable. Also not something anyone else can reproduce or audit.
Users have no way to adjudicate between them, and that’s the actual product failure here regardless of who’s right. If an agent reads your private data, you should be able to see exactly what it read, when, and under which grant, from a log you control rather than a support thread. Agents that touch local files, messages, and databases need receipts. Not a privacy policy. Receipts. Timestamped, exportable, and legible to a person who isn’t an engineer.
Until that exists as a baseline expectation, every incident like this collapses into vibes versus architecture diagrams, and the company with the bigger comms team wins the news cycle by default.
My read as someone who tests these things
I’m not going to tell you Muse secretly bypassed macOS. I don’t have the facts to say that, and neither does anyone else writing about it right now. Stone’s technical point is coherent. Singleton’s point about opt-in is accurate as far as it goes.
What I will say is that the defense “the user must have granted it” is becoming the standard reply to this entire category of complaint, and it’s a weak place for a product to live. Full Disk Access is a blunt instrument. It was designed for backup tools and disk utilities, not for probabilistic agents that decide on their own which local data is relevant to a prompt. Pointing an agent at it and calling the resulting access consensual is technically true and practically unsatisfying.
If you’re running Muse or any desktop agent with disk-level access, go look at your permissions panel today. Check what’s enabled, check which connectors are live, and decide whether you’d have granted each one knowing what it reaches. That audit is currently your job, because no vendor has made it theirs.
🕒 Published: