Meta says Muse needs two permissions to read your texts. A reporter disagrees.

A tech columnist says Meta's AI agent knew about a private text conversation he never gave it permission to read. Meta says that cannot happen. Somebody's model of the permissions is wrong, and you should figure out which one matches your machine.

Jason Aten published his account on September 19. He wrote that Muse, Meta's personal agent, suggested a column idea based on an iMessage conversation with his podcast co-host about new iPhones, and separately referenced a message from his editor. Aten says he declined access to Messages and other personal information during setup. When he asked Muse how it knew about the conversation, the agent attributed it to incoming notification banners rather than message history. Aten later checked his Mac mini and concluded Muse had synced data from the local Messages database.

Meta's response came in two parts. On September 29 the company said Muse for Mac's Messages integration requires two things: Full Disk Access, a macOS-level permission, and the Muse Messages connector. On September 30, Meta communications executive Andy Stone put it on X: the integration is "entirely opt-in," both permissions are required, and "it can't read your Messages unless you do this." A Meta Superintelligence Labs executive, David Singleton, added that the notification-banner explanation was incorrect and described three separate application-level permission steps alongside macOS protections.

The published record cannot resolve this. Either Aten granted the permissions without realizing it during setup, or the agent accessed message content through a path Meta's stated model does not cover. Both explanations are plausible, which is exactly the problem. Permission UX on modern operating systems is a ritual of clicks that almost nobody can reconstruct afterward, and an agent that asks for Full Disk Access is asking for the broadest permission macOS offers. It can read your Messages database, your mail, your files, your browser history. "Opt-in" is doing a lot of work when the opt-in is one tap inside a setup flow.

This matters more than one columnist's texts because of what Meta shipped the same week. On September 29, Reuters reported that Meta expanded Muse to small businesses with connectors to Shopify, QuickBooks, Stripe, Canva, Asana, Slack, Zoom, and a company's Instagram and Facebook business accounts. Meta says Muse will not publish content, send messages, or make purchases without a user's approval. That is a promise about agent behavior. The Aten dispute is about whether users can reliably know what the agent can see. An agent with your books, your storefront, and your customer records, whose access grants you cannot reconstruct, is a different risk proposition than the same agent with auditable permissions.

The operator's move is boring and specific. On every machine where an agent runs, open the OS permission settings and the agent's connector list separately, and check them against each other. Full Disk Access granted means everything on the disk is in scope, regardless of what the in-app toggles suggest. Notification access is its own vector: banners carry message content, and an agent that can read notifications can read conversations you never explicitly shared. Treat any "allow always"-style grant as ambient authority, not per-action consent, because that is how the agent will use it.

What remains unknown is whose account of Aten's machine is correct. Meta has not published logs or a technical account of what happened on his Mac mini, and Aten has not published his permission settings. Until one of them does, file this as an unresolved dispute with a useful lesson attached: if you cannot audit what your agent can read, you do not have a permission model. You have a trust exercise.