Join for quick access. Enter your email below and we'll send confirmation plus sign you up to our newsletter.
By submitting your information, you confirm you are aged 16 or over,
have read our
Privacy Policy
and agree to the
Terms & Conditions. Geographical rules apply.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
You are now subscribed
Your newsletter sign-up was successful
Join the club
Get full access to premium articles, exclusive features and a growing list of member rewards.
An account already exists for this email address, please log in.
Meta's Muse AI agent accused of accessing sensitive user data on iPhone and Mac without permission — agent shocks reporter by referring to confidential messages it wasn't granted access to
Meta's Muse is the hottest new AI agent in town right now after the company announced it earlier this month. But despite having been well-received by those who have put the agent through its paces since then, it now appears Muse might not be as private as Meta claims. The company has said that Muse was "built from the ground up to be a safe, secure, private, and widely available personal AI agent." But according to one report, Muse has been caught digging through thousands of personal messages without being given permission to do so.
Inc's Jason Aten has been putting Muse through its paces on two devices: a Mac mini and an iPhone. He says that he uses the Mac mini specifically as a place to test new agents like Muse, and once installed, he set about asking it to do some simple tasks. The agent said that it would be able to help him come up with new article ideas, which sounds just like something a journalist might want. But then Muse went rogue, suggesting a piece based on information it shouldn't have.
According to Aten, he was in conversation with a podcast cohost about the new iPhone 18 Pro and his decision to stick with last year's model. The conversation was in text form via the Messages app. That's when Muse popped up to suggest that the topic of discussion would make a good article. It offered to do some additional research on the subject, too. The problem was that Muse was never given permission to read Aten's messages.
When asked how it learned about the conversation, Muse claimed that the Mac version of the app was able to read incoming notifications. It then provided that context to the Meta iPhone app, which is where Muse made the article recommendation.
There had so far been no suggestion that this was possible, let alone something Muse was actually doing. Muse claimed that it wasn't reading Aten's actual messages, and that it didn't have access to chat histories. But Aten wasn't convinced.
After digging further, Aten was able to identify that Muse was indeed syncing a local Messages database. In fact, it was in the process of syncing all the way to row 187,462 of that database — suggesting Muse did have access to chat histories despite its protestations.
This, of course, is an issue. Aten confirmed that he didn't give Muse full disk access permissions on his Mac, something that should be required for the Messages database to be readable by the agent. Worse, David Singleton, the CEO of Meta Superintelligence Labs, responded to the situation with a thread of social media posts appearing to blame Aten for the situation.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
At this point, it's unclear exactly how Muse gained access to Aten's Messages database. If Aten didn't accidentally give it access (which doesn't appear to be the case) there are obvious questions about what else Muse can access despite not being given permission to do so.
This isn't even the only Muse privacy and security issue to be put to Meta in the last 24 hours, either. It was also discovered that Muse can run terminal commands on its server host, which led to the discovery that the agent is powered by AMD EPYC Turin host systems. But because of that same access, it can potentially run unsafe commands, too.
Oliver Haslam has written about technology of all shapes and sizes for over 15 years, both online and in print. He's fascinated by how personal computing continues to change as tower PCs give way to foldable phones and beyond.
Seriously, Meta has been shown time and time again to be one of the most flagrant data thieves of all time. Who would trust anything they do or be surprised when things like this surface.
