Meta’s Muse got creepy by guessing its own plumbing

Meta's Muse did not just raise the usual personal AI question: what can this thing see? It raised the more useful one for builders: can the assistant explain its access without making up a privacy story?

That is the part worth watching. Desktop agents will not earn trust by sounding confident. They will earn it by being boringly accurate about permissions, data paths, and what they do not know.

Quick Take

• Fact: The Verge reported on a Threads post from Jason Aten, a contributing editor at Inc., who shared screenshots of a Muse exchange about a conversation he was having in Messages. Muse is Meta's AI assistant, and its Mac app can access local context like Messages, Calendar, and Notes when users grant the relevant permissions.
• Why it matters: Personal AI is being sold as useful because it can live near your real context: calendars, notes, chats, files, and workflows. That can be powerful. It is also exactly where fuzzy explanations become expensive.

  There are two trust systems here.

  The first is the permission system. Does the app require the right OS grants? Are connectors opt-in? Can users re

• Who cares: Teams building Mac or desktop agents should care first. Anything that touches Messages, mail, notes, notifications, calendars, browsers, or files needs a real permission map and a model-facing version of that map.
• Judgment: Fairly hyped as a trust failure for a personal desktop agent; overhyped if framed as proven silent notification spying without independent app behavior checks. Fact: The Verge reports Aten's screenshots, Muse's notif

What happened

The Verge reported on a Threads post from Jason Aten, a contributing editor at Inc., who shared screenshots of a Muse exchange about a conversation he was having in Messages. Muse is Meta's AI assistant, and its Mac app can access local context like Messages, Calendar, and Notes when users grant the relevant permissions.

Aten said he had not given Muse access to his messages. When he asked how Muse knew about the conversation, the assistant answered that it had seen notification previews, not his message history, and said it had not been reading his texts. When pressed, Muse could not give a clean technical path. It claimed the paired Mac app exposes notifications as a capability and that they arrive through device sync.

That sounds like a surveillance story. Meta's public reply pushed back on that reading. David Singleton of Meta Superintelligence Labs responded under the post, according to The Verge, and said message access requires explicit grants, including full disk access for the Mac app. He also said the features are opt-in.

The key detail: Singleton said Muse does not watch notifications on the Mac. His explanation was that Muse syncs Messages data only after the user specifically enables access. He said Muse was confused when it talked about synced device notifications, gave an incorrect explanation, and Meta apologized for the bad answer.

So the clean read is not, "Muse was proven to be silently scraping every desktop banner." The cleaner read is worse for product trust in a different way: Muse sounded sure while describing an access path its own team says was wrong.

Why it matters

Personal AI is being sold as useful because it can live near your real context: calendars, notes, chats, files, and workflows. That can be powerful. It is also exactly where fuzzy explanations become expensive.

There are two trust systems here.

The first is the permission system. Does the app require the right OS grants? Are connectors opt-in? Can users revoke access? Does the UI show what is connected right now? Meta's reply leans on that system: explicit enablement, full disk access, and no notification watching.

The second is the explanation system. When a user asks, "How did you know that?" the assistant needs to answer from the real architecture, not from vibes. Muse appears to have failed that second system. That matters because most users will not inspect logs or permission matrices. They will ask the product in plain language and judge the answer.

A wrong answer here is not a harmless hallucination. It can make the product look more invasive than it is, or make a real access issue easier to talk away later. Either way, the user learns the wrong lesson: do not ask the bot, because the bot does not know what its own eyes are.

For builders, this exposes a missing eval. Standard chat tests reward fluency. Desktop agents need tests for self-knowledge: which data sources are connected, which grants were used, what the model can infer, what it cannot access, and when it should say, "I do not know the exact path."

The safest answer may be less magical. A short, grounded response like "Messages access is enabled in settings, here is the permission used, here is how to turn it off" beats a polished story about notification previews. If the model cannot retrieve its architecture card or current grant state, it should not improvise.

Who should care

Teams building Mac or desktop agents should care first. Anything that touches Messages, mail, notes, notifications, calendars, browsers, or files needs a real permission map and a model-facing version of that map.

Trust, privacy, and security leads should care because viral screenshots will not wait for the incident review. If the assistant gives the wrong explanation, your support team is now debugging both code behavior and chatbot narration.

Buyers should care too. The next agent demo may show a slick context window and a helpful summary. Ask the dull question: where did that context come from, what permission allowed it, and can the assistant answer the same way twice?

What to do this week

If you ship local-context AI, write a one-page architecture card for the model and the user. List data sources, required grants, sync triggers, retention basics, and what the assistant is allowed to say about each path.

Then test the ugly questions:

• Did you read my notifications?
• Which permission did you use?
• What happens if I revoke Messages access?
• Are you guessing, or do you know?
• Show me the setting that enabled this.

Score the agent on accuracy, refusal, and correction, not just tone. Also surface live grant state in the UI. Do not make the chatbot the only audit log for a privacy-sensitive feature.

If you are only watching Meta, keep the distinction clean. The Verge report supports a story about incorrect self-description and Meta's opt-in claim. It does not, by itself, prove silent notification scraping. That still leaves a serious product lesson: an agent that invents its own plumbing is not ready to be the user's trust interface.

Bottom line

Muse looked creepy because it talked like it had seen something through a path Meta says it does not use. The public evidence points less to a proven notification-spying scandal and more to a desktop agent failing to explain its own access correctly.

That is still a big deal. Personal AI will win trust only if "how do you know that?" gets a dull, correct answer every time.

Bandwagon Check

Fairly hyped as a trust failure for a personal desktop agent; overhyped if framed as proven silent notification spying without independent app behavior checks. Fact: The Verge reports Aten's screenshots, Muse's notif

Sources

• Meta’s Muse is creepy, but maybe not for the reasons you think
• Meta's Muse is creepy, but maybe not for the reasons you think

By Sean Smith · AI Bandwagon