Can an AI agent read my messages? A 2026 permissions check

What happened with Meta Muse and the private messages?

In September 2026, a tech columnist said Meta's Muse AI agent had read their private messages on a Mac even though the required permission was switched off. Meta says that couldn't have happened. The columnist had installed Muse on an iPhone and a Mac mini to test it and chose not to give it access to Messages. A few days later, Muse suggested a column idea built on a conversation the columnist had just had with a podcast co-host about the new iPhones. Asked how it knew, the agent said it only saw the text of incoming notification banners. Then the columnist found that Muse had synced the Mac's Messages database up to row 187,462, while the Muse settings still showed Full Disk Access turned off.

Meta pushed back hard. Its head of communications said the Messages integration in the Mac app is entirely opt-in. To use it, you have to turn on Full Disk Access, which is a macOS permission, and also the Messages connector inside Muse. A senior executive at Meta's superintelligence lab added that reading Messages takes three separate layers of app and system permissions, and that a bug couldn't get around them. According to Meta, the Messages options stay grayed out until Full Disk Access is on. Switching it on means confirming a second time in macOS settings, which restarts the app. Meta called the agent's own explanation about notification banners a confused, incorrect answer from the AI. The columnist stands by their account, and nobody has publicly settled it yet.

The useful part for you holds no matter which side turns out to be right. Both explanations involve permissions most people have never looked at. If the columnist is right, something got past the settings. If Meta is right, the agent still gave a confident, wrong account of its own behavior. That's a problem in itself, because you can't ask an AI what it can see and trust the answer. Notification banners are also a real leak that people underrate. On many systems, an app with notification access can read message previews without ever opening your messaging app. So the question "can an AI agent read my messages?" has a practical answer. It depends on which doors you've opened, and you can check every one of them in about ten minutes.

Which permissions let an AI agent see your messages?

An AI agent can only read your messages through a permission that you, or someone with your device, granted. There are four main kinds: full file access, notification access, accessibility or screen access, and a direct account connection. On a Mac, Full Disk Access matters most. The Messages app keeps your conversation history as a database file on disk, and an app with that permission can open it. Notification access is easier to miss. It doesn't open your history, but it lets an app see the preview of every new message as it arrives, including sender names and the first lines of each text. On Android it's a separate permission you have to grant, and it's exactly what many smart-reply and automation apps ask for.

Accessibility and screen-recording permissions come next. Agents that use your computer for you often need them to click buttons and read what's on the screen. While they're working, anything visible is fair game, including an open chat window. Then there are account connections: the "Sign in with Google" or "Connect your inbox" screens that give an assistant ongoing access to your email, calendar or files through your account rather than your device. These don't appear in your phone's privacy settings at all. You manage them from the account's own security page. That split catches a lot of people out. They clean up their phone, feel safe, and forget that the assistant still has live access to their mailbox.

Messaging apps add one more layer. End-to-end encryption protects a message while it travels, but once it's decrypted on your device, any app with the right permission there can see it. Encryption doesn't protect you from software you invited in yourself. That's the uncomfortable truth behind the Muse story: the weak point is rarely the network. It's the pile of permissions sitting on your own machine. Here's our take: notification access deserves more suspicion than it gets. You grant it once, forget about it, and it reads every message that arrives from then on. The table below shows which permission exposes what, so you know what to look for before you start switching things off.

How do you check and revoke these permissions on Mac, phone and PC?

On a Mac, open System Settings, go to Privacy & Security and start with Full Disk Access. Any app switched on there can read files most apps can't, including your Messages history. Turn off anything you don't recognize or no longer use. Next, check Accessibility and Screen & System Audio Recording in the same pane, since that's where computer-use agents get their access. Then go to Notifications and set Show previews to When Unlocked or Never if you don't want banners showing message text. One practical tip: if an agent's Mac app is installed but you've stopped using it, quitting it isn't enough. Remove it from these lists and drag it to the Trash. An app's permissions last long after you stop using it.

On Android, the screen that matters most is Notification access. On most phones you'll find it under Settings, then Apps, then Special app access. The wording varies by manufacturer, and some phones call it Device & app notifications. Every app listed there can read your incoming message previews. Check Accessibility too, under Settings, then Accessibility, then Installed apps or Downloaded apps. The iPhone is simpler, because iOS doesn't let third-party apps read other apps' notifications or your message history. Your job there is to go through Settings, then Privacy & Security, for contacts, photos and files. Also set message previews under Notifications to When Unlocked, so banners don't show your texts on a locked screen.

On a Windows PC, open Settings, then Privacy & security, and go through the App permissions list. Pay attention to notifications, file system and screenshot access. Then do the step almost everyone skips. Visit the security page of your Google, Microsoft or Apple account and review the third-party apps that have access. Remove anything you can't name. Repeat this check every few months, because new permissions pile up without you noticing. If you'd rather not remember it yourself, have your assistant remember it: "Remind me on the first Sunday of every quarter to check app permissions on my phone and laptop." It takes ten minutes, four times a year, and afterwards you know exactly which apps have access to what.

Why is a chat-based assistant easier to trust?

A chat-based assistant is easier to trust because you can see its access. It works with the messages you send it and nothing else on your device. There's no disk permission, no notification reader and no screen access to check. If you want to know what it knows, scroll up. That's how Agent Sonic works. It's an AI assistant that lives in WhatsApp. You message it like any contact, and it works with what you put in that chat: a voice note, a PDF, a question, or a request like "Remind me to call the accountant every Monday at 9." It doesn't read your other WhatsApp chats, your texts or your inbox. Its access ends at the edge of the chat window, and that's easy to understand.

Groups work the same way. Sonic only sees a WhatsApp group if someone adds it, just like adding a person, and it shows up in the member list for everyone to see. Once it's in, it can post catch-up recaps, run polls, keep shared lists, split expenses and send the group's recurring reminders. Remove it and it's gone. The only places it reaches beyond the chat are the tools you choose to connect, such as Google Calendar, Sheets and Docs, or a read-only Notion knowledge base. You turn those on yourself. They don't come switched on by a setting you never noticed. Compare that with a desktop agent that needs access to your whole disk to be useful. Neither design is evil, but only one lets you say what it can see in a single sentence.

Is there a trade-off? Yes, and it's worth being honest about it. A chat assistant can't dig through your laptop to find that email from March. You have to forward it or paste it in yourself. Some people will find that limiting. We'd argue it's the point. An assistant that only knows what you hand it can't surprise you with a column idea taken from a private conversation. Most busy owners want three things: reminders that fire, follow-ups that happen and contracts that get read. For that, sharing on purpose costs a few seconds and buys a lot of peace of mind. If that sounds like the right deal, see how an assistant with no app to install fits into the WhatsApp you already use.

What should you share with any AI assistant?

Here's the rule: share with an AI assistant only what you'd be comfortable forwarding to a capable stranger who works for you, and only the part the job needs. That covers almost every situation. Want a contract summarized? Send it. Need a reminder for a meeting? Send the time and place. Your banking passwords, one-time codes, a partner's medical details or a client's ID scan? No assistant needs those for admin work, so don't send them. The rule works because you don't have to trust any company's account of how its permissions work. Whatever happens behind the scenes, data you never shared can't leak, get misread or turn up later in a suggestion you didn't ask for.

A few habits make the rule easy to follow. Crop or redact before you send. If you need a spreadsheet checked, delete the column of customer phone numbers first. Send the part that matters, not the whole folder: the three clauses you're worried about, not every contract you've signed this year. Choose assistants whose access you can describe in one sentence, and be wary of any app that asks for a sweeping permission on day one so it can "work better." And when an AI tells you how it knows something, treat the answer as a guess, not proof. The Muse story shows why. Whichever side is right, Meta itself says the agent's explanation of its own behavior was wrong. Checking your settings tells you more than asking the bot.

Privacy isn't only about your own messages. Other people's messages matter too. If an assistant is going to contact someone for you, that person should know they're talking to an assistant. Sonic's outreach tasks, available on the Pro plan and currently in Beta, work that way. You say "Ask Dana when the invoice will be ready and let me know." Sonic shows you the exact first message before anything goes out, and nothing is sent until you reply yes. It writes from its own number and introduces itself as your assistant. It never pretends to be you. Anyone who asks it to stop gets a short apology and is never messaged again. If that's the kind of assistant you want, get access here and you'll get Sonic's number and a quick onboarding.

Frequently asked questions