Meta Says Muse Misexplained Its Own Mac Access
After a tester posted screenshots of Muse referencing his Messages, Meta said the Mac app does not watch notifications and that the assistant described its own feature wrongly. What remains unverified is whether the Messages access was actually enabled.
Meta's account is that Muse for Mac did not read notifications; it synced Messages data after access was enabled, and the assistant wrongly described the mechanism. That makes this a self-description failure, not a demonstrated leak. Whether the tester actually enabled that access remains unresolved in the reporting we reviewed.
The Weights Desk · 3 min read- Meta says Muse for Mac does not watch notifications and syncs Messages data only after a user enables access; it says Muse's claim about syncing device notifications was an incorrect explanation.
- No published reproduction shows notification text reaching the model; the only evidence for that claim is Muse's own chat explanation, which is a model-asserted claim.
- Whether the tester had enabled Messages access is not documented with a settings capture in the reporting we reviewed, so consent is the open question.
- The lasting lesson for teams deploying desktop agents is that an assistant's account of its own permissions is not an audit surface; logs and OS settings are.
- Treat the episode as a disclosure and consent gap, not an in-the-wild exploit or a confirmed data leak.
Meta says Muse, its new personal agent for Mac, misexplained its own behavior. Inc. contributing editor Jason Aten posted screenshots to Threads in which Muse appeared to draw on his Messages, and The Verge reports the assistant told him it had seen notification previews. Meta's David Singleton responded that the app does not watch notifications and syncs Messages data only after a user enables access. The unresolved question is consent, not notifications.
What Meta says happened
As The Verge reports it, Meta's position is that Muse "does not watch notifications on your Mac, but rather syncs data from Messages only after the user has specifically enabled access." Singleton, of Meta Superintelligence Labs, added that when Muse said it synced "device notifications," it was confused about how to explain the feature and gave an incorrect explanation. The Verge's reporting also relays that the Mac app needs full disk access to read Messages. This is Meta's account, not an independent finding.
What the tester reported, and what remains open
The Verge reports that Aten shared screenshots of Muse referencing his Messages content and that, pressed on its source, Muse said it had seen notification previews rather than message history, then conceded it could not give the exact mechanism. What is missing is evidence of Aten's permission state: the item we were given does not link his Threads post, we could not retrieve it, and no settings capture appears in the reporting we reviewed. Whether Messages access was enabled is therefore unverified.
What the Mac app is documented to reach
The Mac app's documented reach is broad but described as opt-in. TechCrunch, on September 18, reports it can interact with files, messages, calendar, notes and mail within their native applications, that users control access on an opt-in basis, and that it asks approval before sensitive actions. 9to5Mac, on September 17, reports it works across apps, files, calendar, notes and messages. Neither outlet specifies which macOS permissions it requests, and Meta's September 8 launch post covers iOS, Android and muse.ai without mentioning Mac.
Noise: the claim that Muse was reading notifications
Treat the notification-snooping claim as noise until someone shows otherwise. Its only evidence is Muse's own explanation, which Muse itself hedged and Meta calls wrong. A model's account of its inputs is a model-asserted claim, not a log, a permissions record or a network capture. What has been demonstrated is a chat transcript; what has been theorized is a data path. We found no published reproduction showing notification text reaching the model.
Signal: an agent that misdescribes its own access
The durable signal is that a desktop agent with OS-level reach gave a user a wrong account of what it could see, and the user had no way to audit that from inside the chat. For teams shipping or approving agents, self-report is not an audit surface; provenance has to come from logs and OS permission settings outside the model. Meta's launch post says Muse does not share conversations or VM data with its ad systems, which addresses ad use, not whether the agent can explain its own reach.
Verdict
This is a disclosure and consent gap, not a leak. On the available evidence Meta's explanation is plausible and unrefuted, and Muse's self-description was wrong either way. Security teams evaluating Muse for Mac should check Full Disk Access and Messages settings on each machine and treat the assistant's statements about its own permissions as unverified. The question reopens if a settings capture shows Messages sync occurring without the user enabling it.
- Did Meta's Muse read notifications on a Mac?
- Meta says no. As The Verge reports it, Meta's David Singleton said Muse does not watch notifications on the Mac and syncs Messages data only after a user enables access. He described Muse's statement about syncing device notifications as an incorrect explanation of the feature.
- What can the Muse Mac app access?
- TechCrunch reports the app can interact with files, messages, calendar, notes and mail in their native applications, on an opt-in basis, and asks approval before sensitive actions. The Verge reports it can reach Messages, Calendar and Notes and needs full disk access. Neither TechCrunch nor 9to5Mac lists the specific macOS permissions.
- Is this a data leak?
- No leak has been demonstrated. What exists is a chat transcript in which Muse gave a wrong account of its own access, plus a Meta explanation. No log, settings capture or network trace has been published showing data leaving the device or being used without enablement.