According to Singleton, Meta’s Muse application cannot read a user’s Apple Messages conversations by default. He explained that for the AI agent to access message data on a Mac, two distinct settings must be manually enabled by the user. The first requirement is granting the app macOS system-level Full Disk Access—an elevated permission managed directly within the Apple operating system settings. The second requirement is manually toggling on a dedicated Messages connector setting located inside the Muse application interface itself.
“The Messages integration in the Muse Mac app is opt in,” Singleton stated in his public post. “Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”
The implication behind Singleton’s response was immediate and unequivocal. By asserting that dual-layer authorization was required, Meta’s CTO suggested that Muse could have read Aten’s private Messages communications only if the columnist had explicitly turned on both permissions himself. Under Singleton’s framing, if private messages were ingested by the AI assistant, the user had only himself—and certainly not Meta—to blame for the outcome.
However, security experts and technical observers quickly challenged Meta’s explanation, arguing that the executive’s defense glossed over fundamental aspects of how permissions operate within the macOS ecosystem. macOS security expert Patrick Wardle raised strong doubts regarding Singleton’s denial, pointing out a critical contradiction between Meta’s official narrative and the underlying mechanics of Apple’s operating system security.
Analysing the situation from a core technical perspective, Wardle noted that granting an application Full Disk Access inherently removes standard privacy barriers across the entire file system. "From a technical point of view, with FDA (full-disk access), any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc," Wardle explained.
Wardle’s technical assessment underlined a fundamental flaw in the defense put forward by Meta. If an application is granted system-level Full Disk Access by the operating system, it possesses the raw technical capability to read virtually any non-root file stored on the local drive, regardless of whether a secondary toggle within the app itself is switched on or off. Under standard macOS permission models, an application holding Full Disk Access does not rely on an internal software switch to gain readable access to chat databases, local browser histories, web cookies, or encrypted messaging stores located in accessible user directories.
