Meta AI Mac
Per-area grants · three revocation places · Meta’s claims marked as claims

It sees more than you hand it.

Not because it is nosy because it has to look around to do the job. Ask it to sort the PDFs in a folder and it reads what else is in that folder. With a chat assistant, privacy is a question about what you disclose. With an agent you are delegating, and the data it touches in passing is the part nobody warns you about.

What you can control Claim vs verifiable
Incidental access is the issue 3 permission layers 4 claims, examined 6 things you can do
One file pointed at, inside a wider ring showing everything in the folder the agent necessarily read “Sort the invoices in this folder by month” everything it had to read to do it invoice-04.pdf invoice-05.pdf invoice-06.pdf tribunal-letter scan-passport payslip-aug old-cv-draft clinic-results tenancy-2023 notes-divorce bank-statement invoice-draft What you meant to share three files What it passed through the whole folder Both are inside the area you granted. Only one was your intention. Grant the folder, not the drive
Invented file names, real shape. The three you meant sit inside a folder full of things you did not.
If you only read one bit

Access is per area, and an area is bigger than a task

The short version

You grant areas, not items so scope the area, not just the instruction

Muse works inside areas you grant one at a time: files, mail, calendar, notes, messages and forms. Within a granted area it reads what it needs to, which is generally more than the specific items you had in mind. Meta says the agent’s work runs in a sandbox it calls the Muse Secure VM, kept out of Meta’s advertising systems, and that it confirms before anything sensitive. Those are Meta’s statements about its own product, and this page treats them as such throughout.

Granted per area Revocable per area Wider than your task Claims are not audits

If you want the shortest possible rule: point it at the narrowest thing that still lets the job work. Everything below is why that sentence does more than it looks like it does.

The distinction worth learning

Intended disclosure versus incidental access

Chat-assistant privacy has a simple shape. You choose what to type or attach, and the question is what happens to it afterwards. The decision point is the moment you press send, and you can see exactly what you handed over.

Agent privacy has no such moment. You describe an outcome file these, find that, update the other and the agent works out for itself what it needs to look at. The scope of what it reads is decided by the task, not by you, and it is decided after you have stopped paying attention.

You did not disclose the folder. You disclosed a job that happened to require the folder. Those feel the same when you type them and are not the same at all.

None of this is misbehaviour. An agent that refused to read a directory listing could not sort a directory. The reach is the capability. But it does mean the honest question to ask before granting an area is not “do I trust this with the thing I am asking about?” it is “do I trust this with everything in the place I am asking about?”

Why this lands hardest on files

Mail, calendar and notes tend to be uniform: your inbox is all correspondence, your calendar is all appointments. A folder is not uniform. Downloads in particular is where people keep the scan of a passport next to a takeaway receipt, and “Documents” accumulates decades of things you would never hand to anyone deliberately.

So the practical advice is duller than a privacy setting and more effective than one: make a folder for the task. Move the twelve invoices into it, point Muse at that, and the question of what else it read answers itself. It costs thirty seconds and it converts an incidental-access problem into an intended-disclosure one, which is the kind you already know how to reason about.

The same logic applies upward. Granting an area is a standing decision, not a per-task one so the area you grant should be the smallest one that makes your ordinary tasks work, not the largest one that makes every conceivable task work.

Related reading:
Permission settings

Three layers, three different places to revoke

These get conflated constantly, and the consequence is people who think they have removed access when they have removed one third of it. Each layer is granted somewhere different and switched off somewhere different.

LayerWhat it controlsWhere you change it
Layer 1macOS system permissions What the operating system will let the app touch at all the prompts macOS itself raises the first time an app reaches for something. This is Apple’s gate, not Meta’s, and it sits underneath everything else. System Settings on your Mac, under Privacy & Security. Revoking here stops the app regardless of what Muse’s own settings say. Setup detail.
Layer 2Muse’s per-area grants Which areas you have told Muse it may work in files, mail, calendar, notes, messages and forms granted individually rather than all at once. Inside Muse itself. This is the layer you will adjust most, and the one worth keeping deliberately narrow. What each area covers.
Layer 3Account integrations Connections to services that are not your Mac Instagram, Facebook, Google Workspace and similar. A different consent entirely, governed by the terms of the service you connected. In that account’s own security or connected-apps settings, not in Muse and not in macOS. Which integrations exist.

The one that catches people: uninstalling Muse does not revoke layer three. An integration you authorised lives in the account that granted it, and it stays there until you remove it from that account. Deleting the app from your Mac has no effect on it whatsoever. Uninstalling properly.

Evidence, honestly labelled

What Meta says, and what that does and does not establish

Meta has made four substantive privacy claims about Muse. They are reasonable claims and we have no reason to doubt them. They are also, from where you are sitting, unverifiable so here is each one with what it would mean if true, and what you can actually check for yourself.

Meta says

The agent works in a sandbox it calls the Muse Secure VM

If true, it means

The agent’s execution is isolated from the rest of the system rather than running loose inside your session, which limits the blast radius when something goes wrong.

It does not mean

That the data it legitimately reads stays on your machine, which is a separate question about transmission, not about isolation.

You cannot inspect this from outside the product. Treat it as a design intention, not a guarantee.

Meta says

That work is kept out of Meta’s advertising systems

If true, it means

What Muse does on your behalf should not turn into ad targeting the outcome most people are actually worried about when they hesitate here.

It does not mean

Not used for training. “Kept out of advertising” and “not used to improve models” are different promises, and a statement about one is not a statement about the other.

Read the training language separately. Meta’s broader terms are the place it lives, not this claim.

Meta says

It confirms before anything sensitive

If true, it means

Sends, purchases and submissions stop and wait for you the single most valuable safeguard an agent can have, because those are the steps with no undo.

It does not mean

That Meta’s definition of sensitive matches yours. Deleting a folder or overwriting a document may not prompt, and those are not trivial either.

This one you can observe. Watch what prompts and what does not on low-stakes tasks first.

Meta says

Private messages are not used unless you share them

If true, it means

Meta’s stated position is that public posts, photos and captions plus your interactions with AI features can improve its models, while private messages with friends and family are excluded unless you bring them to Meta AI yourself.

It does not mean

That handing a thread to an agent leaves it private. Sharing a message with an AI feature is exactly the act the exclusion is conditional on.

Terms change. Read Meta’s current ones rather than any third-party summary, this page included.

We are not implying Meta is being untruthful we have no evidence of that and would say so if we did. The point is narrower: a vendor’s description of its own internals is a claim, and a page that presents claims as findings is not helping you decide anything. The same treatment for Meta AI.

Practical

Six things that actually reduce exposure

Ordered by how much they change, not by how much effort they take. The first two are worth more than the rest combined.

  1. Make a folder for the task

    Move the files the job needs into one place and point Muse there. This single habit converts incidental access into intended disclosure, and it takes half a minute.

  2. Grant areas one at a time, when a task needs one

    Not all six on day one because the setup screen offered them. An ungranted area is the only kind that cannot leak. How grants work.

  3. Connect integrations last, and separately

    Instagram, Facebook and Google Workspace are a different consent with a different scope. Connect one when a task genuinely needs it. What each one opens.

  4. Read the plan before the run

    It tells you what the agent thinks the job involves which is also the clearest preview you will get of what it is about to read. Corrections there are free. Why plans matter.

  5. Learn what prompts and what does not

    Run low-stakes tasks first and watch where the confirmations actually appear. This is the one Meta claim you can test yourself, so test it.

  6. Revoke in all three places, not one

    System Settings, Muse’s own areas, and each connected account. Removing the app covers only the first two. The three layers.

None of these requires trusting or distrusting anybody. They work the same whether Meta’s claims are entirely accurate or not, which is what makes them worth doing rather than worrying about.

Also useful:
FAQ

Data access and permission questions

What data can Muse access?

Whatever is inside the areas you have granted files, mail, calendar, notes, messages and forms for as long as a task needs them. Access is per area and revocable per area, but within a granted area it is not limited to the specific items you had in mind. Why that matters.

Does Muse see things I did not point it at?

Within a granted area, yes, and necessarily so to sort the PDFs in a folder it has to read what else is in that folder. This is incidental access rather than intended disclosure, and it is the part of agent privacy that surprises people.

What is the Muse Secure VM?

It is Meta’s name for the sandbox it says the agent’s work runs inside, kept out of Meta’s advertising systems. That is Meta’s description of its own architecture plausible, and not something a user can inspect from outside. How we treat it.

Is my Muse activity used for advertising?

Meta says the agent’s work is kept out of its advertising systems. Worth holding on to: not used for advertising and not used for training are different promises, and a statement about one is not a statement about the other.

Does Meta train its models on what Muse does?

Meta’s broader position is that public posts, photos and captions, plus interactions with AI features, can be used to improve its models, and that it also draws on information from accounts you connect. Private messages with friends and family are not used unless you share them with Meta AI. Read Meta’s own current terms rather than relying on any summary, this one included.

How do I revoke access?

It depends which layer you mean. macOS permissions in System Settings, Muse’s per-area grants inside Muse, and account integrations in those accounts’ own connected-apps settings. Removing one does not remove the others. The three layers.

Does uninstalling Muse remove its access?

It stops the app running, but an account-level integration you authorised lives in that account rather than on your Mac. Revoke connected-app access separately, in the account that granted it. Uninstalling properly.

Is Muse more of a privacy risk than Meta AI?

It has a wider surface, which is a different thing from being badly behaved. Meta AI sees one window you attach; Muse works across granted areas. More reach means more to think about, which is why granting narrowly matters more here. The comparison.

Can I use Muse without connecting any accounts?

Yes. Account-level integrations are separate authorisations and the Mac areas work without them. Connect one when a task needs it rather than on day one.

What is the safest way to start?

Grant one area, give it a task confined to a folder you would not mind a colleague seeing, and read the plan before the run. You learn how it behaves on low stakes before widening anything. Getting started.

Grant the folder, not the drive

The narrowest thing that still lets the job work.

Every habit on this page survives being wrong about Meta. That is the test worth applying to any privacy advice, including ours.

The six habits How grants work
  • Per-area grants
  • Three revocation places
  • Claims marked as claims
  • US only at launch

Independent guide not affiliated with Meta. Statements attributed to Meta are its own, reported as of September 2026 and not independently verified; terms change, so Meta’s current documentation is the authority on what it does with your data.