Meta said Wednesday that its Muse AI agent cannot read a user's Messages on a Mac unless the user explicitly allows it, pushing back on a tech journalist's account that the assistant accessed his iMessages without permission.

Andy Stone, Meta's head of communications, said in a post on X that the Messages integration in the Muse app for Mac is "entirely opt-in" and requires two separate switches to be turned on: Full Disk Access, a setting in Apple's Mac software that lets an app read files anywhere on a computer, and the Messages connector, Muse's own on/off toggle for that app. Both can be revoked at any time, he wrote.

Let's set the record straight: the Messages integration in the Muse app for Mac is entirely opt-in. You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can't read your Messages unless you do this. And it can be… — Andy Stone (@andymstone) September 30, 2026 (X)

Stone was answering AppleInsider, which reported on the experience of Inc. columnist Jason Aten (previous coverage), who said the AI uploaded his texts to its cloud despite his permission settings.

What Aten says happened

Muse is a personal AI agent, meaning software designed not just to answer questions but to act for the user, such as sending an email or booking travel. Meta launched it on Sept. 8, according to the company's announcement, and it had surpassed 2.5 million downloads by Sept. 23 — roughly two weeks after release.

Meta built Muse inside Superintelligence Labs, its AI research unit, whose first model, Muse Spark, arrived April 8.

Aten said he installed Muse on an iPhone and a Mac mini, declined to give it access to his messages during setup, and checked afterward: Full Disk Access was off.

The agent then pitched him a column idea based on a private text exchange with his podcast co-host. It also flagged a message from his editor about a deadline. When Aten asked how it knew, Muse said it had only seen the pop-up banners of incoming notifications.

Aten said that explanation was not true. He found that Muse had synced his local Messages database — the file where a Mac keeps your text history — up to row 187,462, even though his Mac showed Full Disk Access as off.

What Meta says

David Singleton, who leads Meta Superintelligence Labs, said the notification explanation Muse gave was wrong. In a post on Threads, he said Muse syncs Messages data when Messages access is enabled.

Singleton also said reading Messages takes three separate steps of permissions, and that macOS protections cannot be bypassed even if the Muse app had a bug.

Aten maintains that Full Disk Access was off on his machine and that the texts synced anyway. Meta says Muse cannot read Messages without it. How a sync could run with the switch off remains the unresolved core of the dispute.

The dispute is not the only consent complaint. Separately, YouTuber Matt Robb said Muse gave his home address to a Facebook Marketplace buyer. Singleton said Muse asks permission in such cases, a claim Robb disputes.

Why a toggle matters

An AI agent acts with whatever access a user hands it, making the permission screen the guardrail. Text histories can hold family chats as well as the codes a bank sends to confirm it's you.

This fight is bigger than Meta. Amazon started blocking Muse on Sept. 21, saying it doesn't identify itself while browsing and appears to capture customer credentials. Meta says Muse has no visibility into passwords or payment methods.

Amazon won the first round of a similar fight. On March 10, a federal judge granted a preliminary injunction — a court order that holds while the case continues — blocking Perplexity's Comet from buying on Amazon for users. Taken together, the Messages fight, Amazon's block and the Perplexity case share one theme: how much access consumer AI agents get, and who controls it. The Messages argument, unlike the Perplexity case, has so far played out in public statements rather than a courtroom.