Meta Denies: Muse Does Not Read Messages on Mac Without Permission

Meta has refuted the accusations that its AI assistant Muse accesses messages on Mac without authorization, clarifying that integration requires two explicit authorizations. Andy Stone, Meta's communications manager, specified on X that accessing messages requires both enabling Full Disk Access in the macOS operating system and enabling the Messages connector in the Muse app.

Quick Answer

Muse can only access messages on Mac if the user enables both Full Disk Access and the Messages connector. Meta maintains that these authorizations are necessary and can be revoked at any time. A journalist reported that Muse synchronized his messages despite Full Disk Access being disabled, contradicting Meta's statement.

The controversy arose after the testimony of Jason Aten, a columnist for Inc., who claimed that Muse uploaded his texts to the cloud despite refusing access during setup and Full Disk Access being disabled. Aten discovered that Muse had synchronized the local message database, containing his entire chat history.

The Contradictory Statements

David Singleton, head of Meta Superintelligence Labs, admitted that the explanation provided by Muse regarding message access was incorrect. He explained that Muse synchronizes message data only when access is enabled and that macOS protections cannot be bypassed, even in case of app bugs. However, Aten maintained his position, stating that Full Disk Access was disabled on his device when the messages were synchronized.

The dispute raises critical questions about permission management for AI assistants. These tools operate with the access that users grant, making permission screens fundamental to security. Messages contain sensitive information such as family conversations and bank authentication codes. The controversy goes beyond Meta, involving other platforms like Amazon, which has blocked Muse for alleged security issues.

The Security Implications

Amazon blocked Muse on September 21, stating that the app does not identify itself during browsing and could capture user credentials. Meta responded that Muse has no visibility into passwords or payment methods. This conflict reminds of a previous dispute between Amazon and Perplexity, in which a federal court blocked Perplexity's AI assistant Comet from making purchases on Amazon.

The issue highlights the importance of clear communication about permissions and the security of AI assistants. Users must be aware of which authorizations they are granting and how these can be used. The controversy also underscores the need for robust security mechanisms to prevent unauthorized access to sensitive data.

The Regulatory Challenges

The situation requires a careful examination of privacy and data security regulations. The NIS2 directive and the DORA regulation could influence how these technologies are regulated in Europe. Companies must ensure that their AI assistants comply with these standards to protect user data and maintain public trust.

The controversy between Meta and Aten underscores the importance of complete transparency and reliable security mechanisms for AI assistants. Users must be clearly informed about the permissions required and the potential implications for their privacy. The situation also highlights the need for a robust regulatory framework to ensure that these technologies are used safely and responsibly.

The Impact on the AI Assistant Market

The controversy has put the spotlight on the entire sector of personal AI assistants, which has seen explosive growth in 2026. According to data from Decrypt, Muse surpassed 2.5 million downloads in just two weeks since its launch, becoming one of the fastest products to adopt this technology. The situation also raises concerns for competitors like Amazon's Alexa and Google's Assistant, which operate with similar architectures but with less transparency about the required permissions.

The case highlights how the security of AI assistants is becoming a critical factor in users' choices. According to a report by Meta, 68% of surveyed users stated that they want more controls over permissions before installing an AI assistant. This trend could push companies to invest more in identity access management and Security Information and Event Management (SIEM) solutions to ensure safer management of personal data.

The Implications for Users

For users, the situation underscores the importance of careful permission management and understanding the security settings of their devices. Experts recommend regularly checking the authorizations granted to applications, especially those that require Full Disk Access, a particularly sensitive permission that can be exploited to access critical data.

Furthermore, the controversy has highlighted the need for greater digital education. According to a study by Decrypt, 43% of users do not fully understand the implications of granting permissions like Full Disk Access. This knowledge gap makes users more vulnerable to potential privacy breaches, emphasizing the need for targeted awareness campaigns.

The Challenges for Tech Companies

For tech companies, the Muse case represents a significant challenge in terms of NIS2 compliance and DORA regulation. The NIS2 directive, which will come into force in 2027, requires companies to implement robust security measures to protect user data. This includes the need to ensure that AI assistants are designed with advanced security mechanisms, such as zero trust architecture and Data Loss Prevention (DLP).

Additionally, the DORA regulation, which focuses on digital operational resilience, requires companies to have disaster recovery as a service (DRaaS) and business continuity plans to ensure that services remain operational even in the event of security incidents. The situation with Muse could push companies to review their security strategies and invest in more robust solutions to protect user data.

The Future Outlook

Looking ahead, the controversy between Meta and Aten could lead to a significant change in how AI assistants handle permissions and data security. Experts predict that companies may be forced to adopt higher standards of transparency and security, with a greater focus on penetration testing and vulnerability assessment to identify and correct any vulnerabilities.

Furthermore, the situation could accelerate the development of managed SOC and MDR (Managed Detection and Response) solutions to monitor and respond to security incidents in real time. These services could become essential for companies that want to ensure the security of their AI assistants and protect user data.

The Need for a Robust Regulatory Framework

Finally, the controversy highlights the need for a more robust regulatory framework to ensure that AI assistants are used safely and responsibly. Experts suggest that regulatory authorities may need to intervene to establish clear guidelines and security obligations for companies that develop and distribute AI assistants. This could include the need for ISO 27001 certification and regular security audits to ensure that companies meet the highest data protection standards.

The controversy between Meta and Aten represents a turning point for the AI assistant industry. The implications for security, privacy, and regulation are significant, and companies will need to adapt quickly to ensure that their products are secure and compliant with emerging standards. Users, on the other hand, will need to be more aware of the permissions they grant and the potential implications for their privacy. Only through collaboration between companies, users, and regulatory authorities will it be possible to ensure a safe future for AI assistants.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.