Meta Muse 客户端隐私与安全拆解：macOS、Android 与 iOS 能访问什么

Muse by Meta: what the clients can access

Independent privacy and security research into Muse on macOS, Android and iOS. We inspect the shipped apps, compare versions, test selected boundaries and publish the evidence—including corrections to our own findings.

The concern: connecting personal data to a cloud agent can allow both one-time reads and ongoing sync. The important questions are what it can read, which approvals apply, how much history it can request, and what remains after you disconnect. OS permissions can prevent access; a capability in the code is not proof that your data was uploaded.

Findings · Version history · What we did · Methods · All evidence

What matters on each platform

Latest inspected builds below. Research updated 8 October 2026; this is not a claim that these are the newest releases available today.

Platform / inspected build	Main concerns	What changed since the earlier samples
macOS 6.0	Local messages, mail and files; desktop control; ongoing connector sync; payment-key validation controlled by server inputs.	Removed the bundled browser extension and stealth script. Added connector switch UI and more desktop-control code.
Android 9.0.0.23.178	SMS, notifications, contacts, health and location; historical reads; some sources lack the app's category approval gate. OS gates still apply.	Permissions fell 65 → 61; identified agent photo handlers were removed. This does not rule out all media attachment paths.
iOS 9.1.0	Photo-sync controls, health/location access, new Alo voice and wearable-recording code.	Adds voice/model-configuration and wearable paths; removes the identified Notes-export literals. Third-party decrypted code is not authenticated.

Latest investigations

Payment-key trust: the Mac web client can skip validation of a card-encryption key's certificate chain through a server-deliverable flag or a response field. This is not TLS verification; the flag defaults false and production activation is unknown. Finding and evidence.
Confidential VM verification: newer mobile samples remove the Sigstore/Rekor proof path and retain Cloudflare Plexi auditor signatures. Plexi already existed and is public; the stronger claim that public transparency disappeared was rejected. What changed.
Alo and wearable audio: the iOS sample contains new voice and recording-upload paths. Captured multimango.com site code connects Mango to Muse, but does not establish its legal operator or prove user audio was uploaded there. Investigation.

These are follow-ups on the already inspected builds, not a new release audit.

What we verified—and what we haven't

We checked package signatures and hashes, compared permissions and bundled components, traced selected code paths, and reviewed consent/retention copy. Three older browser-extension behaviors were reproduced in isolated Chromium: page metadata continued while paused, pause reset on restart, and the last command's parameters remained after unpairing. Those results apply to the extension bundled with Mac 3.0/4.1, which is absent from 6.0.

Native Muse apps were not run. We have no captured native production uploads or measured fresh-account defaults. Server retention, deletion, training use and production feature settings remain unresolved. iOS metadata signatures do not authenticate the decrypted instructions. Methods and limits · Next tests.

Follow the research

Understand the problems: findings by concern, then the platform guides above.
See what happened: every inspected version and investigation timeline.
Check the work: 76 evidence files, reproduction instructions and correction log.
Read the background: why this project exists and archived detailed reports.

App archives and full extracted code are excluded from Git. The banner is editorial artwork. Corrections are welcome: open an issue with the build, disputed claim and supporting evidence.

Earlier detailed sections and evidence tables are preserved in the previous report.