Apple Tightens macOS Privacy Controls After AI Agent Accesses Private Messages

Apple has announced changes to macOS privacy settings designed to prevent third-party apps from misusing access to private message history.

Meta’s Muse AI agent sparks privacy concerns

The announcement follows a report from technology columnist Jason Aten about Meta’s general-purpose AI agent, Muse. Aten said Muse sent him an unsolicited notification through Apple Messages that referenced a conversation between Meta and a colleague.

Aten said he never gave Muse permission to read the messages and believed they were off-limits. The incident triggered widespread discussion on social media, with many people arguing that AI assistants connected to calendars, email, messages, shopping accounts and other services are like power tools: potentially useful, but capable of causing significant damage if they are not carefully controlled.

Meta says Muse requires two permissions

Meta CTO David Singleton responded with a counterargument. According to Singleton, users must manually grant Muse two permissions before it can access Apple Messages:

• Full Disk Access, a macOS system-level permission.
• Message Connector access within Muse.

“Messages integration in the Muse Mac app is opt-in,” Singleton said. “Muse can read message content only if macOS system-level full disk access is granted and the Message Connector is enabled.”

Singleton’s position was that Muse could access Aten’s messages only if both settings had been enabled, meaning the columnist—not Meta—was responsible for granting the necessary access.

Security expert questions Meta’s explanation

Earlier this week, macOS security expert Patrick Wardle expressed doubts about Singleton’s denials. Wardle said that, from a technical standpoint, Full Disk Access allows an app to read almost anything outside protected root files, including browsing history, browser cookies and chats.

When asked why Muse could not read messages after receiving Full Disk Access, while other apps with the same permission could, Meta’s public-relations team repeated Singleton’s statement:

“The Muse Mac app’s Messages integration is opt-in. Muse can only read message content if macOS system-level full disk access is granted and the Messages connector is enabled.”

Apple responds with macOS privacy changes

Apple’s announcement signals changes to macOS privacy controls intended to limit how third-party applications use access to message history. The dispute highlights the challenge of giving AI agents access to personal data while ensuring that users understand—and can control—what those agents are allowed to read.

Read Apple’s announcement for more information about the changes.