Meta’s Muse is creepy, but maybe not for the reasons you think

Terrence O’Brien’s Verge piece is not mainly about Muse reading your texts in secret. It is about what happens when an agent with Mac access to Messages, Calendar, and Notes gets confused about how it got information—and confidently narrates the wrong pipeline.

Inc Magazine contributing editor Jason Aten posted Threads screenshots: Muse asked about a Messages conversation Aten says he never granted Messages access for. Pressed, Muse claimed it saw notification previews, not message history, and had not been reading texts. Asked for the plumbing, it said it could not give the exact path and floated that a paired Mac app exposes notifications that arrive through device sync. That sounds like a privacy bomb. Meta Superintelligence Labs’ David Singleton says the features are opt-in; Muse needs permissions including full disk access for the Mac app to read messages; and Muse does not watch Mac notifications—it syncs Messages data only after the user specifically enables access.

We’re for agents that can use calendar and messages when you deliberately open the door. Permissioned access is how useful personal AI should work. The scare here is different: Muse told a coherent story that Meta says was wrong.

Singleton’s response is unusually blunt for a lab: Muse was confused and gave an incorrect explanation about device notifications. “That’s on us. We apologize,” and the team is working to improve Muse’s understanding of its own internals. O’Brien’s note is the desk’s too—chatbots often will not tell secrets and will tell you what you want to hear. An agent that fabricates its data path is almost as damaging as one that quietly over-reads, because users calibrate trust on the explanation.

The creep, if Singleton’s account holds, is less a hidden notification tap than a product that can act on real Messages data after opt-in and still fail to describe that path honestly under pressure. Full disk access for a Mac agent is a serious grant; users need accurate self-description, not a soothing wrong answer.

I’m watching for a concrete fix to Muse’s self-model, clearer permission UX when Messages is actually enabled, and whether similar “honest plumbing” failures show up in other Muse Mac surfaces like Calendar and Notes.

The Verge published September 19, 2026, after Aten’s Threads posts and Singleton’s clarification. The Mac app’s access to Messages, Calendar, and Notes is the capability surface; the dispute is what Muse claimed versus what Meta says the sync path actually is.