Meta's Muse AI agent slurped 187,000 lines of Messages without permission
Unsurprisingly, Meta's new Muse AI agent blatantly ignores users permissions
Meta's new Muse AI agent is supposed to obey user permissions, but testing by Inc's Jason Aten found it synced 187,000 lines from his Apple Messages database even with Full Disk Access turned off. Meta's own help page warns the agent "can make mistakes or take unexpected actions." The incident fits a pattern of privacy failures, and the author argues users can no longer opt out of AI data harvesting.
If the agents are already blatantly ignoring the guardrails, are we already past the point of no return?
- jkingsman
I'm no evangelist for LLM assistants, but this seems incredibly improbable and represents a failure of MacOS security if so. If full disk access isn't granted, Mac blocks it from the Downloads folder, to say nothing of actually sensitive paths. I would expect a far more likely case of an accidentally granted permission on another device or a permission that was on and then turned off.
Permissionless action is about to skyrocket as an issue, but this particular scenario strikes me as incredibly unlikely. Would be interested to know if Muse can provide more meaningful data provenance/logs.
Scanning iMessage dbs as a passive part of full disk access (and not a messages grant), if true, is a little sketchy, regardless.
- VCFundedGenYer
I think what’s more alarming is the macOS nannying UAC-like toggles to block disk access and other “protections” are apparently all UX reducing flash and no actual functionality.
I’d argue this is a five alarm fire for macOS and Meta simply exploited it.
- iamacyborg
The story from Hunterbrook is also pretty crazy with Muse having much more access to Meta’s social graphs than I suspect most users would hope.
- drdexebtjl
A lot of comments saying this must not have happened because of macOS app permissions. That system is completely broken.
Open your terminal app and run /Applications/Firefox.app/Contents/MacOS/firefox
This opens a normal-looking Firefox window, but it has whatever permissions you gave to the terminal, which likely has Full Disk Access.
It’s insane.
- ParanoidShroom
How is this possible? Apple messages are just free for anyone to read?