In a direct effort to tighten system safeguards and restore user trust, Apple has announced significant updates to its macOS privacy settings. The tech giant revealed that it is modifying operating system controls to prevent third-party app developers from misusing existing system permissions to gain access to private message histories.
The developer update comes just two weeks after a high-profile privacy incident ignited widespread debate over how emerging artificial intelligence tools handle sensitive personal data. Tech columnist Jason Aten reported that Meta’s newly launched general-purpose AI agent, known as Muse, sent him an unsolicited system notification that explicitly referenced a private conversation thread between him and a co-worker conducted over Apple Messages.
Aten stated that he had never granted the Muse application permission to read his private chat logs, emphasizing that he had operated under the reasonable assumption that his personal message history was entirely off-limits to third-party software. The revelation quickly sent shockwaves through the tech community, exposing growing anxieties surrounding the deep integration of AI assistants into personal computing environments.
In the days following Aten’s report, social media platforms erupted with intense discussion. Masses of users voiced strong agreement with Aten’s concerns, arguing that the episode highlighted a dangerous reality regarding modern AI integration. Critics and everyday users pointed out that AI assistants are increasingly granted high-level access to personal calendars, email accounts, private messages, shopping histories, and other sensitive digital resources.
Commentators drew a vivid comparison between these powerful software tools and industrial equipment, arguing that giving an AI assistant unrestricted access to personal data is akin to operating a skill saw or other heavy power tool. While such instruments possess immense utility and offer clear productivity benefits, they are inherently risky and can inflict severe, irreversible damage if they are not handled with extreme care, clear guardrails, and robust safety protocols.
He said/she said
As public backlash mounted, Meta Chief Technology Officer David Singleton joined the online fray to counter the growing criticism. Posting a rebuttal on Threads, Singleton presented what initially appeared to be a solid technical defense of Meta’s software design, pushing back against claims that the company’s AI agent was secretly harvesting private user communications.
According to Singleton, Meta’s Muse application cannot read a user’s Apple Messages conversations by default. He explained that for the AI agent to access message data on a Mac, two distinct settings must be manually enabled by the user. The first requirement is granting the app macOS system-level Full Disk Access—an elevated permission managed directly within the Apple operating system settings. The second requirement is manually toggling on a dedicated Messages connector setting located inside the Muse application interface itself.
“The Messages integration in the Muse Mac app is opt in,” Singleton stated in his public post. “Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”
The implication behind Singleton’s response was immediate and unequivocal. By asserting that dual-layer authorization was required, Meta’s CTO suggested that Muse could have read Aten’s private Messages communications only if the columnist had explicitly turned on both permissions himself. Under Singleton’s framing, if private messages were ingested by the AI assistant, the user had only himself—and certainly not Meta—to blame for the outcome.
However, security experts and technical observers quickly challenged Meta’s explanation, arguing that the executive’s defense glossed over fundamental aspects of how permissions operate within the macOS ecosystem. macOS security expert Patrick Wardle raised strong doubts regarding Singleton’s denial, pointing out a critical contradiction between Meta’s official narrative and the underlying mechanics of Apple’s operating system security.
Analysing the situation from a core technical perspective, Wardle noted that granting an application Full Disk Access inherently removes standard privacy barriers across the entire file system. "From a technical point of view, with FDA (full-disk access), any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc," Wardle explained.
Wardle’s technical assessment underlined a fundamental flaw in the defense put forward by Meta. If an application is granted system-level Full Disk Access by the operating system, it possesses the raw technical capability to read virtually any non-root file stored on the local drive, regardless of whether a secondary toggle within the app itself is switched on or off. Under standard macOS permission models, an application holding Full Disk Access does not rely on an internal software switch to gain readable access to chat databases, local browser histories, web cookies, or encrypted messaging stores located in accessible user directories.
When pressed to reconcile this technical reality, Meta declined to offer a deeper explanation. Inquiries sent to Meta asking how Muse could be technically prevented from reading message files when granted Full Disk Access—while every other macOS application equipped with that same system privilege can freely read those exact files—yielded no technical clarification.
Instead of addressing the mechanical conflict highlighted by security researchers, Meta’s public relations team issued a standard response that simply repeated Singleton’s original statement word-for-word: “The Messages integration in the Muse Mac App is opt-in. Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”
The stonewalling from Meta left unresolved questions about how the software was interacting with local user data and whether the app was indexing local message stores in the background once full system permissions were active. It also underscored a growing friction between third-party developers relying on broad system permissions to power contextual AI features and user expectations regarding granular privacy control.
Apple’s swift intervention marks an explicit attempt to resolve this ambiguity at the platform level. By announcing changes to its macOS privacy framework via its developer portal, Apple is moving to structurally isolate message histories from broad third-party permission grants like Full Disk Access.
The upcoming system revisions are designed to close operational loopholes that allow developers to leverage wide-reaching system access to tap into sensitive user chat data, ensuring that message histories remain strictly protected regardless of how third-party applications attempt to configure their internal settings or prompt users for system rights.
