Muse for Mac: What It Can Do, Permissions and Risks

Muse for Mac is Meta's free desktop app that lets the Muse agent work with your local files and with Messages, Notes, Reminders, Mail and Calendar on your Mac. You choose, per app, whether Muse has no access, read-only access, or permission to read and act, and it asks before sending email or making purchases. It launched September 17–18, 2026, is US-only, and shares the same weekly usage limits as your Muse plan.

It's also the newest and least-tested way to run Muse, with a reported unpatched security issue in its first week. Read the risks section before installing.

What Muse for Mac does

The Muse agent normally lives in a cloud VM. The Mac app extends it to your own computer. Meta's announcement, quoted by 9to5Mac, says: "It works across apps, files, calendar, notes, and messages on your computer. You control what it can access."

That opens tasks the cloud agent can't do alone:

• Find, read or update files on disk.
• Read an iMessage thread and draft a reply.
• Turn an email into a Reminder or Calendar event.
• Pull notes from the Notes app into a document.

At Connect on September 23, Meta went further and announced Mac computer use, so Muse can operate "any app on your Mac" (Meta). Meta's chief AI officer framed it as: "You can walk away from your computer and it keeps working for you on all the jobs you lined up" (TechCrunch).

How to install Muse for Mac

Download it free from ai.meta.com/muse/download and sign in with your Muse account. The Mac app draws from the same weekly allowance as the phone app, and paid plans raise the limit (see Muse pricing). Meta hasn't published minimum macOS or chip requirements.

If you haven't set up Muse yet, do that on your phone first: how to get started with Muse.

Permissions Muse for Mac asks for

Meta's help page lists three macOS permissions:

Permission	Why Muse wants it
Full Disk Access	"so your agent can find, read or update files"
Automation	"so your agent can perform actions on apps that store information locally"
Notifications	"so your agent can tell you when a task it was working on is done"

Full Disk Access is the big one. It lets an app read almost everything in your user account, including other apps' data. Grant it only if you need file tasks.

Per-app controls: Off, Read only, Read and interact

For iMessage, Notes, Reminders, Mail and Calendar, you choose one of three levels:

• Off: the agent can't access that app's data.
• Read only: "your agent can read that information when you ask it something, but can't do anything in the app."
• Read and interact: "your agent can read that information and perform actions in the app."

A sensible start is Read only for Mail and Messages, Read and interact for Reminders and Calendar, where mistakes are cheap to undo.

Built-in safeguards

Per Meta's help page:

• Muse asks for confirmation before "important action[s], such as sending an email or making a purchase."
• Deleted files go to the Trash so you can recover them.
• You can turn off use of your data for AI training in Settings.

Meta's own warnings are worth quoting in full: "Your agent may be inaccurate or take unexpected actions. Monitor its actions carefully," and "Computer use gives your agent broad reach across your Mac, so only grant access you're comfortable with."

The Muse for Mac zero-day

Days after launch, Malwarebytes reported a zero-day found by Patrick Wardle. An undocumented Muse setting controls which server handles dictation. A local app, terminal command or malware can change it to redirect dictation to an attacker's server, exposing your voice prompts and your Muse account auth token.

It isn't remote: an attacker needs something running on your Mac first. But because Muse can reach email, messages, calendars and payments, Malwarebytes argues a compromised agent is more dangerous than typical infostealer malware. Malwarebytes didn't mention a patch or a Meta response, and none had been reported as of September 22. Wardle's advice was blunt: "Please don't install."

If you do install:

• Keep macOS and Muse updated, and check for a fix.
• Don't grant Full Disk Access unless you need it.
• Avoid giving Muse email, chat, payments and device permissions all at once.
• Watch for unexpected re-authentication prompts.

What's inside the Mac app

Mahdi Salmanzade published a static privacy teardown of Muse 3.0 for macOS alongside the phone apps. It documents shipped tools for iMessage, WhatsApp, Mail and screen control, background sync, and a bundled Chrome extension. That's useful context for what the app can reach, whether or not every tool is switched on for you.

Alternatives builders made before the official app

Before Meta's app, people bridged Muse to their Macs themselves. Muse Mac Connector is an open-source menu-bar app that exposes an authenticated tool set over a Cloudflare tunnel, so Muse can take user-approved actions. muse-fileapi exposes whitelisted directories with two-phase writes and an audit log. Both give you narrower, auditable access than Full Disk Access, which some people will prefer.

If you'd rather run a model on your Mac with nothing leaving it, Muse Glimmer runs locally on Apple Silicon. See running Muse Glimmer locally.

Should you install Muse for Mac?

If you already use Muse and want it working on your files and Apple apps, the per-app controls are well designed. Start with Read only, skip Full Disk Access unless you need it, and wait for Meta to address the dictation issue if your Mac holds anything sensitive. If you're new to Muse, start on the phone or in WhatsApp.

Frequently asked questions

Is Muse for Mac free?

Yes. The download is free and uses the same weekly usage limits as your Muse account. Paid plans, Power at $20 a month and Max at $100 a month, raise those limits.

What apps can Muse access on a Mac?

Meta lists iMessage, Notes, Reminders, Mail and Calendar, each set to Off, Read only or Read and interact, plus files via Full Disk Access. Meta announced computer use for any Mac app at Connect 2026.

Is Muse for Mac safe?

It asks before sending email or buying things and moves deleted files to the Trash. A researcher reported a zero-day in September 2026 that could expose voice prompts and auth tokens if malware is already on the Mac, with no patch mentioned at the time.

Is Muse for Mac available outside the US?

Not yet. Like the rest of Muse, it's US-only for now.