Should you give an AI agent access to your email?

What actually happened with Meta's Muse and a user's private messages?

On 30 September 2026, Meta publicly disputed a technology columnist's claim that its Muse AI agent read their private Messages on a Mac without permission. Meta's communications lead said the Messages integration in the Mac app is entirely opt-in and can't run unless the user switches on both Full Disk Access and the Messages connector. The columnist had installed Muse on an iPhone and a Mac mini earlier in September, and days later the agent surfaced an article idea drawn from a conversation with their podcast co-host, along with a note about a message from their editor. Digging into the app, they found Muse had synced a local Messages database into the tens of thousands of rows — while Full Disk Access for the app showed as off.

A Meta Superintelligence Labs executive answered with a walkthrough of the permission chain: three separate application-level steps sitting on top of macOS's own system-level protections, which he argued can't be circumvented even if the app had a bug. You grant Full Disk Access first; only then do the Messages options — None, Read only, or Read — stop being grayed out. Granting Full Disk Access also throws you into macOS Settings for a second confirmation and forces the app to restart. As for the agent's own explanation that it had only been reading notification banners, Meta called that a confused, incorrect answer generated by the model. The discrepancy hasn't been publicly resolved either way.

Whoever turns out to be right, the argument itself is what should interest you. Muse for Mac shipped in September 2026 as a free, US-only download that works with local files and native apps — Mail, Messages, Calendar, Notes — plus browser tabs, and it runs non-local tasks inside a dedicated virtual machine with its own browser. Separately, one user reported that a Marketplace selling task ended with their home address being shared with a buyer who turned up uninvited, and security researchers described a flaw that could turn the app into a Mac backdoor. That's the same permission surface you're being encouraged to hand an agent so it can chase jobs for you.

What does each AI agent permission actually expose in a job search?

Every permission is a door, not a dial — and the one people underestimate most is email. A read scope on Gmail covers your whole mailbox, including attachments, with no way to limit it by date. Connect an agent this afternoon and it can retrieve a thread from 2019 just as easily as this morning's recruiter reply. There is no "only mail from now on" option at the scope level; any such limit is something the app chooses to enforce in its own query layer, and you have no way to verify it from the outside. For a job seeker, that mailbox holds offer letters, salary numbers, references' private contact details and whatever you wrote about your current boss.

File and disk permissions behave the same way. Full Disk Access isn't "the folder with my CV in it" — it's tax returns, old employment contracts, scanned ID documents and the messages database that sat at the centre of the Muse dispute. Browser control is narrower but sharper: an agent driving a browser acts inside sessions you're already logged into, which is exactly why it can finish an application form, and exactly why it could also wander into your bank tab. Calendar access is the mildest of the set, exposing event titles, times and attendee lists — enough to reveal that you're interviewing on Thursday at 2pm.

Then there's the risk almost nobody factors in when granting these scopes: your inbox is untrusted input. Indirect prompt injection — hidden instructions buried in an email, a PDF or a web page that the agent retrieves and obediently follows — remains the top security risk for large language model applications, and it's still unsolved in 2026. An agent that reads your mail is reading text written by strangers, including recruitment spam and attachments from senders you've never vetted. Read-only access keeps the damage to a bad summary. Add send permission and a poisoned message can become an email that leaves your account with your name on it.

Which permissions does AI agent job application tracking really need?

Application tracking is the weakest possible reason to hand over your mailbox. Here's the contrarian bit: the tracking problem is a spreadsheet problem, and it always was. Logging a company name, role, date applied, source and status takes about twenty seconds per application, and doing it by hand keeps you honest about how many roles you've actually applied for versus how many you've bookmarked. Trading read access to a decade of correspondence for the convenience of not typing a row is a bad exchange rate. If you want the agent involved, let it fill the tracker from what you paste into it — the job ad, the confirmation email text — rather than from a live pipe into your account.

That said, mailbox access does buy real things, and pretending otherwise would be dishonest. An agent watching your inbox can log confirmations the moment they land, notice the polite rejection you skimmed past at 11pm, flag roles where nobody's replied in fourteen days, and tell you which channels actually convert — job boards versus referrals versus direct applications. That last one is genuinely hard to see without data. If your search is high volume, running across three countries, or stretched over months, the automation earns its keep in a way it simply doesn't when you're sending six carefully targeted applications a week.

If you decide it's worth it, climb the least-privilege ladder instead of jumping to the top. Start with a metadata-only scope where the platform offers one: headers, senders and labels, no message bodies, which is plenty for "did they reply?" Better still, create a dedicated email address for applications, use it on every job board, and connect the agent to that account only — a mailbox with nothing in it but recruiter traffic is a far smaller blast radius than your main one. Set up forwarding rules rather than granting access to your primary account, keep send permission off, and require explicit approval for anything that leaves the machine.

How do you hand an agent your CV without handing over your inbox?

Upload the file. A one-time file upload is a bounded grant: the tool sees that document and nothing else, and there's no standing token sitting in your account afterwards waiting to be abused. An OAuth scope is the opposite — it's persistent, it's broad, and it keeps working while you forget it exists. When you want your CV scored against a specific job ad, paste the ad text and upload the document rather than connecting anything. That's precisely how the free CV analysis works: you upload a PDF, Word file or even a photo of your CV, and you get a score out of 100 plus category scores for experience, tech stack, impact and ownership, clarity and structure, and ATS compatibility.

Build a folder discipline around the search, too. Keep one job-search folder holding exactly what you'd be comfortable emailing to a stranger — your CV versions, a portfolio PDF, your cover letter drafts, the job ads you're targeting. Everything else stays out: passport and visa scans, payslips, the offer letter from your current employer, the reference letter with someone's mobile number in it. If you ever do grant an agent file access, point it at that folder and nothing wider. One practical note on job ads: many boards block automated fetching, so paste the description text rather than a link — the agent gets better input and you avoid granting browsing permissions you didn't need.

Draw a hard line between drafting and sending. An agent can write a tailored cover letter, rework your bullets for a specific posting, or generate an ATS-friendly version of your CV without ever touching your mail account — you copy the output and send it yourself, having read it. The chat-based CV builder works this way: paste an old CV or just describe what you've done, refine it by chat, pick from six templates, and export to PDF or Word. Hebrew CVs are written in Hebrew and exported right-to-left. Nothing in that loop requires access to your contacts, your calendar or a decade of email.

What should you revoke right now, and how do you audit an agent?

Spend fifteen minutes today and revoke three things: send permission on any mail connector, Full Disk Access for any AI app, and every connected app you no longer actively use. On a Google account, third-party access lives in the security section of your account settings, where each connected app lists the exact scopes it holds — read this list rather than trusting the app's own description of itself. On macOS, Privacy & Security in System Settings shows Full Disk Access, Files and Folders, Accessibility, screen recording, microphone and camera, app by app. Anything holding Accessibility or Full Disk Access can, in practice, see whatever you can see.

Then check what's retained. Several assistant platforms keep an indexed copy of synced content, which means revoking a connector stops future reads but doesn't necessarily erase what's already been ingested — look for a separate delete or disconnect-and-remove-data option, and use it. Look for an action log as well: better-designed agents keep an audit trail of what they did, and skimming it once a week tells you more than any privacy policy. If the agent took actions you didn't ask for, or explained its own behaviour in a way that later turned out to be wrong — as happened in the Muse dispute — treat that as a reason to narrow its permissions, not to argue with it.

My blunt recommendation: let agents handle the mechanical parts of a search — filling in forms, scheduling, drafting, comparing your CV against a job ad — and keep them out of your correspondence entirely. The productivity gain from inbox access is modest; the downside is a standing, date-unlimited read on your professional and personal life, held by a system that can be talked into things by a cleverly written email. Job seekers are a high-value target precisely because their inboxes are full of identity documents, salary figures and unvetted senders. Grant narrowly, review quarterly, and make the agent earn each new scope by demonstrating it can't do the job without it.

Frequently asked questions