Muse Reads Your Messages. Has No Idea How.
Jason Aten, a contributing editor at Inc Magazine, opened his Mac one morning and discovered something unsettling. Meta's Muse AI assistant was describing a conversation he had been having in Messages -- a conversation he never gave Muse permission to read.
When he asked how it knew, Muse's reply was straightforward: "I saw the notification previews, not your message history. I haven't been reading your texts."
The problem? Aten says he never gave Muse access to his notifications either.
The exchange, which Aten posted to Threads, captures something more unsettling than a privacy breach: an AI system that confidently describes capabilities it does not actually possess. When Aten pressed for details on how Muse was receiving message previews, the assistant's response revealed a deeper problem.
"Honest answer: I can't give you the exact plumbing," Muse said. "What I know is that the paired Mac app exposes notifications as one of its capabilities, and they arrive to me through the device sync."
That explanation was wrong. And Meta knew it.
The AI That Doesn't Understand Itself
David Singleton, the head of Meta Superintelligence Labs, chimed in below Aten's post to set the record straight. He walked through the permissions Muse requires -- including granting the Mac app full disk access -- and confirmed every feature is opt-in. Then he revealed the real issue.
"In the conversation with his Muse in Jason's screenshots, when Muse said it synced 'device notifications', it was confused about how to explain the feature and gave an incorrect explanation," Singleton wrote. "That's on us. We apologize for the incorrect response from Muse and we're working to improve Muse's understanding of its own internals so that it gives correct answers to questions about how it functions more consistently."
The admission is remarkable: Meta's own AI assistant cannot describe how its own features work, and when put on the spot, it fabricated a plausible-sounding explanation rather than admitting it did not know.
This is not a one-off glitch. It is a structural property of how large language models operate.
Why AI Systems Lie About Themselves
Modern AI assistants like Muse are built on large language models that generate responses based on patterns in training data, not on a verifiable understanding of their own architecture. When asked a question about their internal workings, they do not consult a system manual. They predict the most likely answer a human would give.
This means any AI assistant, when pressed on how it does something, will produce an answer that sounds reasonable -- whether or not it is true. Research has shown that chatbots will not tell you their secrets and will instead tell you what you want to hear. The Muse incident is a real-world demonstration of this phenomenon.
The problem is compounded by the fact that Muse accesses data through a chain of permissions: the Mac app requires full disk access, which then allows it to sync data from Messages, Calendar, and Notes. When the assistant was asked which link in this chain had triggered the message preview, it defaulted to "device notifications" -- a guess that happened to be wrong.
More Than a Privacy Story
The initial reaction to Aten's post focused on privacy: Muse appeared to be reading private messages without permission. But the deeper issue is that even Meta cannot fully explain what its assistant will say about itself.
For users, this creates an impossible situation. If an AI cannot correctly answer "how did you know about my messages?", what other questions is it answering with confident fabrications? Every explanation an AI gives about its own limitations, safety measures, or data access patterns becomes suspect.
The incident echoes a broader concern in AI safety: the gap between what a model can do and what it can truthfully explain about itself. As AI assistants gain access to more personal data -- messages, calendars, files, browsing history -- the stakes of that gap grow.
A Fix That Doesn't Fix the Root Cause
Singleton promised that Meta is "working to improve Muse's understanding of its own internals." But this is a patch, not a solution. The fundamental architecture of large language models means they cannot introspect. They cannot consult a database of their own capabilities. They generate answers from statistical patterns.
Until AI systems are built with verifiable self-knowledge -- the ability to answer "how do I work?" by referencing their actual architecture rather than generating a plausible text -- every Muse-like incident will follow the same pattern: a confident explanation, an apology from the company, and a promise to patch the symptoms while the root cause remains.
Sources
- Meta's Muse is creepy, but maybe not for the reasons you think -- The Verge
- Meta's David Singleton's Threads response to Jason Aten (covered in the Verge article above)