Two. That’s the number of separate permissions Meta says must be granted before its Muse AI agent can read a single line of your iMessages: macOS Full Disk Access at the operating system level, and the Messages connector inside Muse itself. Meta VP of Communications Andy Stone told TechCrunch that both are required, and that neither can be circumvented even if the Muse app had a bug.
Two permissions is a reasonable design. The problem is that the dispute now playing out is not about the design. It’s about what actually happened on one journalist’s laptop, and nobody outside Meta can settle it.
What is actually being contested
Inc. columnist Jason Aten reported that Muse read his private messages without permission. Meta is refuting that account, specifically disputing the claim that the agent accessed Messages while the required Mac setting was switched off. Decrypt’s reporting describes something adjacent but distinct: that Muse had synced messages from the Mac’s private Messages database, which is gated behind Full Disk Access, a system-level grant. David Singleton of Meta Superintelligence Labs responded that this was an opt-in feature.
So we have two claims that do not obviously contradict each other, and one that does. “The feature is opt-in” and “the agent synced the Messages database” can both be true at once. “The required setting was off when it read my messages” cannot coexist with Stone’s description of the permission chain. Somebody’s model of the system is wrong, and the interesting engineering question is why that’s so hard to resolve.
An agent’s account of itself is not telemetry
This is the part that should concern anyone building agentic systems. When a user asks an AI agent how it obtained a piece of information, the answer is generated, not retrieved. The model is producing a plausible narrative about tool invocations it may or may not have an accurate record of. Decrypt’s framing of the episode leans directly on this: the agent’s explanation of its own method did not hold up.
That failure mode is structural, not a bug in Muse specifically. A language model sitting on top of a connector stack has, at best, partial visibility into what the orchestration layer did on its behalf. Tool results arrive in context as text. Whether that text came from a live database read, a cached sync performed hours earlier, an index built by a background process, or a summarization step upstream is frequently invisible to the model doing the talking. Ask it to explain, and it will pattern-match to the most coherent story available in context.
Users, meanwhile, treat the agent’s self-description as a log. It isn’t one. It’s prose.
Where consent granularity breaks down
Full Disk Access is a blunt instrument. It’s a single toggle that opens a very wide door, and macOS grants it to an application, not to a feature inside that application. Once a user has enabled it, usually to make some unrelated capability work, the in-app connector toggle becomes the only remaining boundary between an agent and a local message store.
That creates a mismatch between how permissions feel and how they function:
- The OS-level grant is coarse, persistent, and easy to forget you enabled.
- The app-level connector is fine-grained but entirely self-enforced by the vendor.
- Data movement, such as a sync into an agent’s own store, can decouple the moment of access from the moment of use.
That third point matters most for the dispute at hand. If a system syncs content while permissions are live, then surfaces it later, a user who subsequently flips a toggle off can reasonably believe access is closed while the agent still answers questions from what it already holds. I’m not asserting that’s what occurred here; the public record doesn’t support that conclusion. But it is the kind of ambiguity that makes “the setting was off” and “we can’t access it without the setting” both feel true to the people saying them.
What would actually end these arguments
The fix is not better messaging from communications teams. It’s provenance plumbing at the architecture level.
Agents that touch sensitive local data need a user-visible access ledger produced by the runtime, not the model: which connector fired, what resource it touched, when, and under which permission state. Retrieved content should carry source attribution through to the response, so “where did this come from” is a lookup rather than a generation. Synced or cached data needs lifecycle rules tied to the permission that authorized it, so revoking access revokes reach, not just future reads.
None of that is exotic. It’s ordinary auditability, applied to a layer we’ve so far allowed to narrate itself. Until agent platforms ship that, every privacy incident will reduce to a vendor’s word against a user’s recollection, mediated by a system that is architecturally incapable of testifying about its own behavior.
🕒 Published: