Meta’s new personal AI agent, Muse, is facing scrutiny after a technology columnist reported that the assistant accessed information from his private Apple Messages database in a way he says he neither expected nor knowingly authorized. The episode raises an important question: how much access should an AI agent receive simply because a user grants broad system permissions?
According to columnist Jason Aten, Muse initially told him that it could only see incoming notification previews and could not access his Messages history. His investigation, however, indicated that Muse had synchronized information from the local Messages database. Meta’s David Singleton subsequently said Muse’s explanation of how it obtained the information was incorrect and that access depended on permissions enabled by the user.
The controversy therefore appears less about proven covert surveillance and more about meaningful consent and transparency. Giving an application “Full Disk Access” may technically authorize extensive access, but users may not understand that this could expose years of messages to an AI agent.
Meta says Muse was designed around user control. The company says users choose which applications to connect and how much access Muse receives. It also says Muse operates inside a dedicated Secure VM, protects credentials separately, maintains an audit trail and seeks approval before certain sensitive actions.
The broader concern extends beyond Meta. Personal AI agents increasingly require access to emails, calendars, documents, messages, financial services and other sensitive information to become genuinely useful. The more autonomous agents become, the greater the consequences of ambiguous permissions or excessive data access.
The Muse episode highlights an emerging principle for the agentic-AI era: permission should not automatically equal informed consent. AI platforms will increasingly need granular permissions, purpose limitation, transparent data mapping and continuous auditing so users know exactly what their AI can see, why it needs that information, and what it does with it.
