Meta’s AI Read 187,000 of a Person’s Messages. Who Owns Them Now?

Last month Muse, the personal AI assistant Meta launched on September 8, gave Jason Aten a good idea. Jason writes a technology column for Inc., and Muse suggested his next topic: a conversation he’d had with his podcast co-host about the new iPhones. It was the kind of suggestion that only comes from knowing what someone writes about, who they work with and what they’ve been talking about lately.

Then Muse brought up a text from his editor about a deadline, which was odd, because Jason had told Muse to stay out of his messages. He asked how it knew, and Muse said it only saw the message notifications that pop up on his screen. He went digging through Muse’s settings and found Messages switched on anyway, with Muse’s copy of his message history past 187,000 entries.

Don’t ask Muse about Muse

Jason told Decrypt he refused Messages access when he set Muse up, then found it switched on in Muse’s settings anyway. He also checked Full Disk Access, the Mac setting that lets an app read every file on the computer, and it was off. Responding to his story, Meta said that Muse can only read your messages if both are switched on, but it hasn’t explained how Messages ended up on for Jason.

When Jason asked Muse how it knew about his editor’s deadline, it told him, “It’s the incoming notification stream only, not access to your texts.” Meta executive David Singleton later admitted that answer was wrong. Muse gave a false account of what it had collected, and Meta confirmed it, so asking Muse what it knows about you or what it has access to won’t get you a reliable answer.

Apple rewrites an eight-year-old rule

Apple created Full Disk Access in 2018. On October 2, nine days after Jason’s story broke, Apple told developers that apps will soon need “very explicit user action” to get it, because it exposes “everything on their systems, including files, mail, messages”. Apple didn’t name Meta or Muse but the connection seems clear, Apple is tightening up access to customer data because it doesn’t trust AI agents.

Apple gave its reason in one sentence: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.” You’ll still be able to give an AI access to everything on your Mac if you want to, but Apple is saying the risk is yours.

The part nobody measures

Alex Volkov, host of the AI show ThursdAI, splits AI progress into three parts:

1. the model
2. the software around it that lets it take action
3. context, what the AI knows about you.

Models and the software around them get tested and ranked in public almost every week. Nobody measures the third, even though it decides whether an AI is any use to you.

Muse shows why the third part matters most. It became useful by pulling together everything it could find about Jason, his work and years of his conversations. Every AI is limited by how much it knows about the person using it, and none of them improve by knowing less.

What Meta gets to keep

Under Muse’s terms and privacy policy, Meta can use the data Muse collects for its own purposes, and the terms set very few limits on what those purposes are. Delete something and Muse can keep what it learned from it. Ask Muse what it remembers and it will show you some of it, but nothing in the terms gives you all of the context Muse has built about you, or a way to take that context to another AI.

Your context is becoming the most valuable thing you can own in AI, because an AI is only as good as what it knows about you. A smarter model that knows nothing about you still gives generic answers. Today the value of everything Muse knows about its users stays with Meta.

More of your life, every year

Last December, in the second installment of this series, we argued that the AI with more context about you would always beat the AI with the better model. Each new kind of AI, from chatbots to agents to assistants like Muse, has needed more of your life than the one before, and the next ones will need more still. The collection of your personal data has only begun, and your context will be worth more every year.

Muse’s idea for Jason came from his own life, and under Muse’s terms Meta can use what it learned from that life, even after he deletes it. At Bot Food we think the context that makes your AI useful should belong to you, not to the company that built the AI.