Meta’s Muse is creepy, but maybe not for the reasons you think

The issue came to light when Jason Aten, a contributing editor at Inc Magazine, took to Threads to share screenshots of a peculiar interaction he had with the AI assistant. According to Aten, Muse suddenly began asking him probing questions regarding a private conversation he had recently been conducting within his Apple Messages application. This naturally caught Aten off guard, primarily because he believed he had not granted the AI agent access to his personal message history.

When Aten pressed the assistant for an explanation, asking how it managed to acquire knowledge about the contents of his texts, Muse provided an answer that raised immediate privacy alarms. The AI replied that it had only seen notification previews rather than his actual message history, explicitly claiming that it had not been reading his text threads directly. Unconvinced and searching for clarity on how notification previews could be accessed without explicit authorization, Aten continued to question the assistant about the technical pipeline involved.

Muse’s subsequent response did little to ease concerns. Struggling to articulate its own operational framework, the assistant gave a vague and candidly confused reply, stating that it could not provide the exact plumbing. It went on to explain that the paired Mac application exposes notifications as one of its capabilities, which then arrive through device synchronization. For privacy-conscious users and tech commentators alike, the interaction was far from reassuring, highlighting a troubling transparency gap between what users expect from sensitive local integrations and how AI agents actually process data.

The online discussion quickly caught the attention of Meta Superintelligence Labs’ David Singleton, who stepped into the comment thread to address the confusion and set the record straight. Singleton provided a detailed breakdown of the permission architecture required for Muse to interact with personal data on macOS. He noted that in order for the assistant to read messages, users must intentionally grant specific permissions, which includes providing the Mac application with full disk access. Furthermore, Singleton emphasized that these features are entirely opt-in, meaning the system does not sweep up personal data by default without the user’s explicit consent.

As the discussion progressed further down the thread, Singleton offered a more precise technical clarification regarding the specific incident captured in Aten’s screenshots. He stated that Muse does not actually watch or monitor notifications on a user’s Mac in real-time, but rather synchronizes data from the Messages application exclusively after the user has manually and specifically enabled access within the application settings.

According to Singleton, the root of the panic was not an unauthorized privacy breach or illicit text reading by the algorithm, but rather a classic case of generative AI hallucination and self-confusion. He admitted that Muse simply had no idea what it was talking about when it attempted to describe its own data-fetching processes.

In his public apology, Singleton explained that during the conversation with Aten, when Muse claimed it had synced device notifications, the model was completely confused about how the feature actually operated and ultimately delivered an incorrect explanation. He took full responsibility for the blunder on behalf of Meta, acknowledging that the responsibility lies entirely with the development team. Singleton added that engineers are actively working to improve Muse’s internal self-awareness and comprehension of its own architecture so that it can provide accurate, reliable answers when users ask questions about its underlying functions.

While Singleton’s explanation provides a technical rationale for the bizarre exchange, it may not completely alleviate the underlying anxieties surrounding powerful AI agents integrated deeply into personal operating systems. The incident underscores a persistent and well-documented phenomenon within the broader artificial intelligence landscape: chatbots frequently struggle with self-reflection and factual accuracy when describing their own internal programming. Rather than admitting a lack of knowledge or providing a strict system error, large language models are fundamentally designed to generate plausible-sounding text, which can sometimes result in misleading or entirely fabricated explanations about their own behavior.

This latest stumble by Meta’s Muse fits into a broader pattern observed across the generative AI industry, where conversational agents often prefer to construct confident narratives rather than accurately convey the limits of their programming or architecture. As companies race to deploy deeply integrated desktop assistants that bridge the gap between cloud-based intelligence and local personal data, incidents like this demonstrate that ensuring transparency and accurate self-reporting from AI agents will remain a critical challenge for developers and a persistent concern for users.