Facebook on Android watches on a 90 second clock. This post is the other Meta app, Muse. It is not a feed. It is built to do things on the phone as you.
Muse is com.facebook.aura 13.0.0.4.159. Internal name is Hatch. The label on the phone says Muse. I unpacked the APK, decoded the manifest, and decompiled it with JADX. About 60,000 classes. This phone was not rooted, and I did not sit and exercise every tool, so this post is what the binary is built to do. It is not a log of Muse acting on my account that afternoon. MobileConfig can flip tools on from the server. Class names under com.facebook.aura.* were left readable, which is why the capability list is specific.
Facebook mostly watches. Muse is built to act. It can read and send texts, read and answer notifications, place calls, and edit contacts and calendar. It sits on the same com.facebook.* stack, so whatever it touches can be joined to the same account as the 90 second location trail.
What each permission grants, and what the code does with it
| Permission | What the grant sounds like | What Muse is wired to do |
|---|---|---|
| Fine and coarse location | Where am I | LocationGetHandler / HatchLocationProvider. The agent can ask for a fix. |
ACCESS_BACKGROUND_LOCATION |
A vague “even when closed” line | Geofences. Set, list, remove, with a radius and a persistent flag. “When you arrive” and “when you leave” fire while the app is closed. |
| Notification access | Not a normal runtime permission. It is the special access toggle. | NodeNotificationListenerService extends the notification listener. Every notification from every app can be read, opened, dismissed, or replied to. That includes banking apps and SMS notifications, not just Muse’s own. |
READ_SMS / SEND_SMS |
See texts, maybe send one you typed | DeviceSmsReader searches the inbox. DirectMessageDraftSender calls SmsManager.send*, splits multipart messages, and waits on delivery. It can send as you. Direct send is tied to being the default assistant. |
CALL_PHONE |
Tap to call | PhoneCallHandler places calls. |
READ_CALL_LOG |
Recent calls | DeviceCallLogReader searches the whole log. |
READ_CONTACTS / WRITE_CONTACTS |
Pick a contact | Search, create, update, and delete. Also resolves SMS sender names. |
READ_CALENDAR / WRITE_CALENDAR |
Add an event | Create, update, and delete events and reminders. |
Nineteen health.READ_* permissions, plus history and background |
Steps, maybe | Steps, heart rate, HRV, resting HR, VO2, weight, body fat, body water, bone mass, lean mass, sleep, exercise, distance, elevation, floors, calories, height, BMR. HealthSyncManager can pull Health Connect in the background. |
CAMERA |
A photo for the chat | Assist camera and capture. |
RECORD_AUDIO and FOREGROUND_SERVICE_MICROPHONE |
Voice chat | Voice, plus a microphone foreground service that is allowed to keep running. |
Photos, selected photos, ACCESS_MEDIA_LOCATION |
Attach a picture | DeviceMediaStoreReader reads the library, ML Kit labels the images, and the client uploads to rupload.meta.ai. |
AD_ID |
Ads | The Google advertising ID, on a product that also has your SMS and health data if you granted those. |
USE_BIOMETRIC |
Unlock | Biometric unlock / 2FA. The OS returns success or failure, not the fingerprint. |
BLUETOOTH_SCAN / BLUETOOTH_CONNECT |
Pair headphones | Wearables. Ray-Ban-class glasses via a Hatch wearables link. |
RECEIVE_BOOT_COMPLETED |
Start at boot | HatchBootReceiver. It comes back after reboot without you opening it. |
| Foreground service types: special use, microphone, media playback, plus wake lock | A sticky notification | Long-running assistant work, including server-initiated device commands (NodeCommandService). |
| Wi-Fi multicast, Wi-Fi state, network state | Network status | NetworkStateHandler. State, not a full AP census like the Facebook app’s 90 second scan. |
POST_NOTIFICATIONS |
Its own banners | Its own banners. Push delivery is separate and still works if you hide them. |
DETECT_SCREEN_CAPTURE |
You never get a prompt | Knows if you screenshot its content. |
CREDENTIAL_MANAGER_QUERY_CANDIDATE_CREDENTIALS |
Sign in faster | Can query the OS credential manager. |
| Play Billing | A subscription | A subscription. |
One manifest flag I do not like: com.google.android.ALLOW_PHISHING_DETECTION is set to false. The app turns off Android’s built-in phishing check for its webviews.
The <queries> list lets it see whether these are installed: Facebook, Instagram, WhatsApp, Messenger, Google Docs, Google Health, 1Password, plus anything that handles web, tel:, or smsto: intents. That is install-time package visibility, not a runtime prompt.
The commands, because the permission is not the whole story
The agent does not just hold the permission. There is a command surface under com.facebook.aura.commands. The UI strings do include consent lines (“wants to check your calendar”). The capability is still the server-driven tool, and NodeCommandService is described as server-initiated device commands.
| Command | What it can do |
|---|---|
| Notifications | Read, open, dismiss, reply. Per-app block list exists. Default is the whole shade. |
| SMS | Search, draft, send, attachments. |
| Call log | Read and search. |
| Contacts | Search, create, update, delete. |
| Calendar | Create, update, delete events and reminders. |
| Geofence | Arrive / leave triggers on background location. |
| Health | Sync the Health Connect scopes, including background. |
| Photos | Read, label, upload. |
| Phone | Place a call. |
| Apps | Launch apps, check updates, add a shortcut, push to become the default assistant. |
| Background session | Keep running until you kill it from the notification. |
| Battery, network, alarms | Read battery and radio state. Set, list, and dismiss alarms. |
| VM browser | A cloud browser streamed to the phone. Below. |
What you cannot turn off by denying the prompts
Deny every runtime permission and these still exist:
- Boot receiver.
- FCM. Push is not the notification permission.
- Wake lock, and a websocket to
wss://shortwave.facebook.com. - Device model, a device id, battery, network state.
- The install-time app list from
<queries>. - Advertising ID.
- Experiment tags on uploads.
There is also a cloud browser. The APK ships noVNC and a native websocket bridge. Classes like VmAgentComputerSurface and AgentBrowserLiveViewer stream a Meta-hosted browser to the phone, with a “take over” control and a clipboard in both directions. It is logged in as the Meta account. So local permission denials do not stop an agent that is already inside a server-side browser with that identity.
Memory, glasses, and other people’s hardware
The app has a memory view. One of its own strings says messages you delete can stay in the agent’s memory. Another string tells the agent to read an export from a different assistant and keep the durable facts. OAuth goes through www.meta.ai, and the asset fbpermissions.json lists SSO into Facebook, Messenger, Instagram, and WhatsApp. SMS, calls, location, health, and photos are in a position to be joined to that graph if you granted them.
Glasses pairing is a first-class path. There is also a “community devices” mode whose own copy says an unverified third-party device can get full access to Muse: read and send messages, change files, approve actions, use the browser. The warning in the binary says that is dangerous. I would treat that warning as the feature, not the fine print.
If you keep it installed
- Do not give it notification access.
- Do not make it the default assistant. That is the system voice layer and the direct SMS send path.
- Location: deny it, or approximate only, if you do not want geofences.
- Deny SMS send and contact write if you do not want it acting as you.
- Photos: selected photos only. Health sync is optional and broad.
- Do not pair a device you did not buy from someone you trust.
Boot, push, device id, the advertising ID, and the cloud browser do not depend on those toggles. Uninstall, and log out of the Meta account, is the actual off switch.
The LX/ names around the readable classes are Redex. “Can do X” here means the path is compiled and wired. It does not mean your install has that tool enabled today. I did not get that from a rooted runtime. I got it from the APK.
What this means if you do not live in the code
Muse is a different kind of risk from Facebook. The Facebook app, on a timer, builds a log of where you are and what is around you. Muse is an agent. The permissions are not there so it can personalize a feed. They are there so it can read your texts, send a text as you, read every notification on the phone, place a call, change a contact, and edit the calendar. Health is not “steps.” The manifest asks for heart rate, sleep, weight, body composition, and the rest of Health Connect, including a background sync.
Two details decide how bad that is.
- Notification access is the whole shade. It is not Muse’s own banners. It is the listener Android uses for every app’s notifications. Banks, one-time codes, and the text that just arrived all show up there. That toggle is not a normal permission prompt. It is a special-access screen, and the code is written to use it.
- A browser in their cloud does not care what you denied on the phone. The app ships a remote desktop-style browser, logged in as the Meta account, with a clipboard in both directions. Deny SMS and contacts locally and an agent that is already in that browser can still act as you on the web.
The risks, stated as what the code supports:
- It can impersonate you, not just observe you. Send SMS, place a call, delete a contact, delete a calendar event. Those are write permissions. A watcher cannot do that. An assistant can.
- Your other apps leak into it through notifications, if you grant that access. The apps do not get a vote.
- Health, messages, location, and photos sit on one Meta account, the same account the Facebook app ties to a device ID. Deleting a chat in Muse does not, by the app’s own strings, guarantee the assistant forgets it.
- An unverified “community device” is described in the binary as full access: messages, files, approvals, the browser. The app warns that this is dangerous. Treat that warning as the feature.
- Boot, push, and the advertising ID do not ask. You can deny every runtime prompt and the app can still start after reboot and still be woken.
What I am not saying. I did not capture Muse sending a text on this phone. I did not root the phone and watch the commands come down. The honest claim is: this version is built to do those things, the commands have names, and several of them only work if you grant a specific permission. If you do not grant notification access, do not make it the default assistant, and do not allow SMS and contact writes, the acting-as-you paths are the ones that go dark. The cloud browser and the device ID do not.
Next to this, Facebook on a jailbroken iPhone is the check on what a live session actually writes when the app is merely open.