Meta's Muse Denies Reading Messages After Notification Claims Fuel Distrust

Responses from Meta’s AI assistant Muse suggesting access to users’ private messages are attracting attention. While the Mac app is designed to integrate with Messages, Calendar, and Notes, the assistant itself misexplained how it works. According to reporting by The Verge’s Terrence O’Brien, the core of the issue is the gap between how notifications are handled and how permissions actually work. The reason it remains unsettling despite being a capable assistant is not simply whether a monitoring function exists. Its inability to accurately describe its own internal operations reveals a structural weakness in current conversational AI.

Muse for Mac: Permission Scope and Specifications

Muse for Mac is designed as an assistant that incorporates users’ work context. By connecting to Messages, Calendar, and Notes, it aims to help with scheduling and drafting. According to reports, these integrations are opt-in and must be explicitly enabled by users. Reading Messages requires granting full disk access to the Mac app. Because it steps into OS-protected areas, a multi-step approval process is in place.

This design is typical for OS-integrated assistants. The app syncs data only within the scope of granted permissions, which the model then references. The behind-the-scenes handoff is hard for users to see. As a result, users have difficulty understanding which data was synced and when. The design of permission defaults and display wording becomes a factor that determines trust.

Meta’s recent product operations have also sparked debate over feature enablement and billing. As Meta Pauses Conversation Focus Charges shows, the company has been adjusting the terms for assistant-related features. Strict opt-in and clear explanations are prerequisites for acceptance. The current Muse case can be placed on the same continuum. It raises the question of balancing useful functionality with data protection.

Threads Post Highlights Distrust

It started with a Threads post by Inc. Magazine contributing editor Jason Aten. He shared screenshots of his conversation with Muse, saying the assistant referenced the contents of his Messages conversations. He said he had not granted access to Messages. When asked for the basis, the assistant reportedly replied:

“I saw the notification previews, not your message history. I haven’t been reading your texts.”

It claimed it had only seen notification previews, not message history. When Aten further asked how it obtained the notification previews, the assistant could not give a clear mechanism. The response quoted in the reporting read:

“Honest answer: I can’t give you the exact plumbing”

The assistant said its companion Mac app exposed notifications as an available feature, delivered through device sync. But it did not show the specific handoff steps. From the user’s perspective, suspicion remained that it had touched data that was never authorized. The vagueness of this response amplified distrust.

Meta Executive’s Explanation and Apology

Following the post, Meta Superintelligence Labs’ David Singleton offered an explanation. He listed the permission steps required to read Messages. He said users must enable multiple stages, including full disk access. He stressed the feature is opt-in and not designed to sync private messages without permission.

The key point is the latter part of his explanation about whether notifications are monitored. Singleton said Muse does not constantly monitor notifications on the Mac. He said it only syncs data from Messages after the user has specifically enabled access. He then acknowledged that the explanation shown to Aten about having synced device notifications was wrong. His position was that the assistant became confused when explaining the feature and gave an inaccurate answer.

He apologized for the incorrect response. He said Meta would improve the assistant’s understanding of its own internal operations and increase the accuracy of answers about features. The following passage reflects Meta’s view:

“does not watch notifications on your Mac, but rather syncs data from Messages only after the user has specifically enabled access.”

It combines a denial of unauthorized collection with an admission of an explanatory error. The framing is that the problem was not improper data acquisition but a failure of self-explanation. Whether this distinction holds will be a point for future verification.

Structural Challenge of AI Unable to

Explain Itself

What stands out in this case is that the assistant could not describe its own permissions and data pathways. The model does not directly observe implementation details of the OS or the app. It generates answers inferentially from training data, given system instructions, and conversational context. When asked about internal handoff procedures, it may therefore produce plausible but inaccurate explanations. It is a case of so-called hallucination occurring in the area of feature explanations.

This behavior is not unique to Muse. By design, conversational AI is tuned not to disclose confidential design information. At the same time, it has a strong tendency to generate answers that meet user expectations. As a result, it may fill gaps with guesswork instead of clearly stating what it does not know. When it comes to permissions and personal data handling, this tendency can lead to fatal distrust.

Building a verification infrastructure is also a challenge. As GNOME OS Test Center, Inspired by Apple TestFlight shows, pre-release testing frameworks are emphasized for OS and app integration. For AI assistants, testing must also cover the accuracy of responses. Self-explanation errors are hard to catch in unit testing. Improvement driven by user reports takes time to restore trust.

Trust Design Challenges for OS-Integrated

Assistants

OS-integrated assistants offer high convenience in exchange for powerful permissions. By touching notifications, calendars, and notes, they can make context-aware suggestions. However, users cannot intuitively grasp which data has been handed to the assistant. When settings screens and the assistant’s statements conflict, suspicions of improper acquisition arise. As in this case, the difficulty is that doubts persist even when permissions are actually disabled.

Default settings also have a major impact. In foundational software, the default enablement scope has sparked debate. The case of Mesa Rusticl Enables Mali Panfrost by Default shows how changes to default settings ripple through user environments. For AI assistants, strict opt-in alone is not enough. Enablement status, sync scope, and how to stop them must be visible at all times.

Corporate accountability also grows heavier. Apologizing for an incorrect explanation is a positive step in terms of transparency. But for users, the fact remains that it felt as if private messages had been touched. Even if there was technically no unauthorized access, a psychological sense of violation remains. As long as assistants state errors with confidence, similar friction will recur. Mechanisms are needed to let users review audit logs of permissions.

Editorial Opinion

Regarding short-term impact. This case is expected to prompt a review of permission displays for OS-integrated assistants over the next 3-6 months. Meta has pledged to improve Muse’s self-explanations, and its style of answering about permission status is expected to be revised. Competitors are also expected to review their explanations about handling notifications and private messages. Companies deploying these tools are expected to review usage guidelines for Mac assistants.

On the long-term view. Over a 1-3 year horizon, an assistant’s ability to explain itself will become a measure of reliability. Logging of data acquisition and visualization of sync scope are expected to become standard features. Users may choose assistants not only for convenience but for consistency of explanations. Models incapable of accurate self-description are expected to be at a disadvantage for business use.

We pose questions from the editorial team. There is the question of who should take responsibility when an assistant gives a wrong explanation. Doubts remain over whether a developer apology restores trust. It is also asked whether the boundary between notifications and message bodies is defined in a way users can understand. Without verifiable records, whether the assistant’s words can be trusted remains an issue.

References

• “Meta’s Muse is creepy, but maybe not for the reasons you think”, by Terrence O’Brien — The Verge, 2026-09-19T20:44:40.000Z (ARR)
• Source URL: https://www.theverge.com/ai-artificial-intelligence/997833/meta-muse-creepy