At a travel counter, a phone beside a passport sleeve and payment terminal makes the permission chain visible. One connected service can expose enough context to research a route and enough authority to book it.
Meta built Muse for that handoff. The agent can keep working after you close the app, use connected services, browse through a dedicated cloud computer, and ask for approval before selected actions.
This Meta Muse permissions analysis examines Meta’s published architecture, current mobile-store disclosures, and the strongest public challenge to its permission story. Neyrotex did not connect personal accounts or run a forensic test, so the article treats the Messages case as disputed and scores only what current evidence can support.
How this Meta Muse permissions analysis was built
The evidence starts with Meta’s launch explanation and the current Muse product page. Store listings confirm the mobile product, pricing shape, platform warnings, and declared data practices.
Independent reporting supplies the counterweight. A journalist said Muse used information from his Messages database after he believed he had declined that access; Meta said the Mac integration requires Full Disk Access and an enabled Messages connector. No public forensic report resolves the disagreement, so this analysis does not declare either account proven.
The score follows the Neyrotex Mobile scale: functionality 25, usability 20, price and value 15, privacy and security 15, stability 15, and updates and support 10. Permission granularity, revocation, auditability, action approval, and the reliability of the agent’s own explanation receive extra weight inside those categories.
The authority path Meta describes
- Connect one service. You choose a connector such as email, calendar, files, or shopping.
- Set its scope. Meta says a connector can separate reading from acting, such as reading mail versus sending it.
- Let Muse plan. The agent works inside a persistent Secure VM with its own browser and stored context.
- Gate outbound work. A separate Sentinel reviews internet-bound activity and asks for approval when required.
- Inspect and revoke. The product promises an audit trail plus controls to change access or disconnect a service.
Muse turns a chat into delegated work
Muse can research, make documents, monitor a goal, manage email and calendar tasks, shop, and use a browser. Meta says it continues in the background and can build a tool when an existing connector does not cover the task.
The App Store listing describes a free app with in-app purchases for iPhone and iPad. The Google Play listing warns that Muse can give wrong information or do unexpected things and asks users to supervise its work.
That supervision burden changes the product category. You are not checking a paragraph before copying it; you may be checking a reservation, sent message, purchase, or background task after several intermediate steps.
Document-based assessment: 78/100
This score measures the published product state and unresolved evidence. Unknown runtime behavior loses points instead of receiving the benefit of the doubt.
Functionality · 22/25
Connectors, a persistent browser, background work, approvals, memory, and multi-step tasks cover a broad assistant job. Neyrotex did not test connector depth or completion quality.
Usability · 15/20
Conversation, approval prompts, and an audit trail lower the learning cost. Permission state spans the Muse app, connected services, and macOS controls, which makes the full authority chain harder to read.
Price and value · 11/15
Meta offers free usage and paid capacity after a limit. The public product page does not give enough detail to judge the long-term price of heavy agent use.
Privacy and security · 9/15
Scoped connectors, a separate Sentinel, credential isolation, revocation, and an audit trail are strong design claims. The disputed Messages case and broad store disclosures keep runtime trust unresolved.
Stability · 12/15
Large mobile adoption and rapid product expansion support confidence in continuity. Store warnings about wrong or unexpected actions, plus untested long-running tasks, limit the stability score.
Updates and support · 9/10
Meta shipped mobile and Mac clients, new connectors, glasses plans, and model updates within weeks. Fast expansion raises the cost of tracking changed permissions and defaults.
Meta’s strongest controls address different risks
Meta says each Muse runs in an isolated Secure VM. Credentials sit in protected storage that the agent cannot read, and a separate Sentinel must approve outbound activity before it reaches the internet.
Those mechanisms protect different boundaries. Credential isolation can keep a password out of model context; Sentinel can evaluate a proposed action; a user prompt can authorize a purchase; an audit trail can record what happened. None of those controls proves that the original connector received the scope the user intended.
Meta also says users can grant an action once, allow it by default, or deny it, then change permissions for each connection. Users can disconnect a service, opt out of model training, and tell Muse to forget selected memories.
The Messages dispute exposes an observability gap
In September, Inc columnist Jason Aten reported that Muse suggested a column based on a private Messages conversation even though he believed he had declined Messages access. He later said the local integration had synchronized rows from the Messages database.
Meta disputed the permission-bypass claim. As TechCrunch reported, Meta said the Mac connector cannot read Messages unless the user enables both Full Disk Access and the Messages connector through multiple permission steps.
The public record supports a narrower conclusion. Muse used message-derived information, the user and Meta disagree about how access became enabled, and the agent gave an explanation about notification previews that did not match the reported database sync. A model’s explanation of its own data path is generated text, not an audit log.
A separate WIRED investigation examined extracted internal instructions that organize memories about people around the user. That design can improve recommendations, but it also brings bystanders into the privacy boundary even when they never installed Muse.
In a dark kitchen, a person removes one connector from a phone while a laptop remains open to system privacy settings. The reconstruction shows the two control surfaces a user must reconcile; it does not depict the disputed journalist’s machine.
Public evidence cannot settle three questions
First, public marketing does not enumerate every connector’s field-level scope, retention period, or default. Store privacy labels describe broad data categories, while a real decision needs the exact data and action each connector can reach.
Second, the Messages dispute lacks a public independent forensic image, permission-state timeline, and connector log. The user’s account matters, Meta’s technical denial matters, and neither substitutes for a reproducible trace.
Third, the announced Confidential VM is a future control. Meta says it plans a version encrypted with a key only the user holds; the current product should be judged on controls available now.
A safe first-session test
- Use a disposable account. Put synthetic events and messages in it, with no personal contacts, financial data, or work documents.
- Connect one source. Grant read-only access when the connector offers it and capture every prompt.
- Ask for one bounded task. Choose research or scheduling that cannot spend money or contact another person.
- Inspect the trail. Compare Muse’s activity log with the provider’s token and account history.
- Revoke access. Disconnect the service in Muse, revoke its token at the provider, then confirm that a repeat request fails.
- Expand one step at a time. Add send, purchase, or file authority only after the prior scope remains understandable.
Verdict: useful delegation with an evidence tax
Muse earns 78/100 because Meta has designed real controls around a capable consumer agent. Scope choices, action approvals, credential isolation, Sentinel review, and an audit trail address risks that simpler assistants leave to the user.
The same capability creates an evidence tax. If Muse surfaces a fact from a message or takes an action while you are away, you need a trustworthy record of the connector, scope, source, approval, and revocation state. The current public evidence does not show that chain with enough precision for sensitive accounts.
Try Muse for a low-risk workflow when its log and the provider’s log agree. Keep sensitive Messages, health, finance, and production work outside the system until you can verify the same chain without relying on the agent’s own explanation.
For related decisions, read Neyrotex’s Bitwarden mobile analysis, the AI in mobile apps guide, or the Mobile Development hub.
