🔍 Read the full analysis: Meta’s AI Agent And Your Messages: What It Can See And How To Limit Access on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse personal AI agent can access data through connected services, including some Meta apps and, with permission, email and Mac Messages. Reports say its instructions create and regularly update profiles of people mentioned in a user’s communications; Meta did not dispute those findings. Muse users can limit access through settings, but people who never signed up have fewer direct controls.
Meta’s Muse personal AI agent can access messages and other information through connected services, and reports say it keeps regularly updated records about people named in those communications, including people who never used the product. Meta announced Muse’s expansion to Singapore on October 27; the privacy questions matter because the person controlling an agent may be able to give it access to conversations involving others.
Muse operates through connectors that let it use information from other services. Meta’s help pages say users can connect email and calendars, while Facebook, Instagram and Threads connect automatically when accounts share an Accounts Center with Muse. Meta Chief AI Officer Alexandr Wang said the Instagram connector includes direct messages and that Muse has a Messenger connector. Meta’s help pages do not spell out the full scope of those messaging connectors.
Email access lets Muse search messages, Meta says, but does not download the entire inbox unless the user asks it to. Calendar connectors can send updates to Muse. On a Mac, the user must grant Full Disk Access and switch on the Messages connector before Muse can access Apple Messages. Meta also says custom connectors may link Muse to other services, but warns that it does not review them.
WIRED and TIME reported that Muse’s instructions direct it to create a page for each person in a user’s life and update information about people mentioned in chats, messages and emails. TIME said the records can include relationships, shared interests and disputes, with updates every hour. Meta did not dispute the reported findings. A company spokesperson told TIME: “Each person stays in control of their Muse and decides how much access it gets.”
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
When One Person Connects a Conversation
The issue reaches beyond people who install Muse. If a user gives an agent access to a conversation, the agent may process information about everyone in it. That creates a gap between who controls the account and who may be described in the resulting records: the user chooses which connectors to enable, while their contacts may have no direct relationship with Muse.
That distinction matters for private messages, family discussions, work communications and group chats. A person may reasonably know that a friend can read a message, but not know that the friend’s AI agent can search, summarize or retain information from it. The practical reach depends on the connector and the task, and the available materials do not establish that Muse reads every connected message continuously. Still, Meta’s policy describes some connector data as shared proactively, and lists messages, connector data and “information about you or others” among information it may collect.
Meta’s financing and chip partnership are also part of the wider business context, not proof of a particular privacy practice. The source reports a $25 billion stock sale at $625 a share, $12.5 billion in preferred stock and a $3 billion Nvidia investment, while Meta plans to deploy Nvidia chips for Muse. Those figures show the scale of the companies’ commercial relationship; they do not independently establish how Muse handles individual messages.
Products Worth Considering
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Access Model
Meta launched Muse in the United States on September 8, followed by Japan on October 23 and Singapore on October 27, according to the source. Meta describes the service as a personal AI agent that runs on a cloud computer, can perform tasks such as answering email and booking tables, and can be used through its app, on a Mac or directly in WhatsApp. TIME reported more than five million downloads within weeks; the source does not provide the precise measurement date or methodology for that figure.
Meta says each user receives a Muse Secure VM, a private virtual machine that other users’ agents cannot access. The company also describes connectors as the route by which Muse interacts with external services. In WhatsApp, Muse is a chat a person opens, according to Meta’s description; that does not mean it automatically reads the person’s other WhatsApp conversations.
Privacy concerns intensified after WIRED reported on Muse instruction files obtained by security researcher Karan Joshi. TIME later reviewed the instructions separately and reported hourly updates to files about users and people mentioned in their communications. These are findings reported by those outlets, rather than a full public technical audit of how the system behaves in every case.
“Muse has connectors like Instagram (incl dm’s), Threads, Facebook (incl marketplace), and Messenger.”
— Meta Chief AI Officer Alexandr Wang, in a post on X
The Limits of the Public Record
Several details remain unsettled in the material available. Meta’s public help pages do not specify exactly what Instagram and Messenger data their connectors can access, how often all connector data is processed, or how long information about non-users remains in Muse’s records. Reports describe hourly updates to people profiles, but the source does not provide an independent technical assessment confirming how consistently those instructions are followed in actual use.
The company’s statement that users control their agents does not address whether people mentioned in conversations can view, correct or remove records created about them. Nor does the source establish that every message a Muse user can access is automatically fed into the agent. Access depends on the connectors and permissions involved, and the source says email is searchable without a full inbox download unless requested.
Meta’s help material reportedly says Muse may retain learned information after a user deletes the original and may “forget” information only “to the best of its ability.” The specific retention periods and the process for removing information about someone who is not a Muse user are not clear from the supplied information.
Settings to Check Before Connecting
Muse users can start by reviewing connected services and disconnecting any they do not want the agent to access. They can also switch off model training, which the source says is on by default, edit Muse’s memory file or reset the agent. Users granting Mac Messages access should check both macOS Full Disk Access and the Messages connector setting. Custom connectors deserve particular care because Meta says it does not review them.
People who do not use Muse have fewer direct controls over what another person’s agent can learn from their conversations. The source points to WhatsApp’s Advanced Chat Privacy as one way to limit information retained in other people’s archives, but does not describe it as a complete block on all possible access. Readers should check the current settings and Meta’s help pages, since controls and product availability can change as Muse expands. Further clarity will depend on Meta publishing more detail about connector scope, retention and ways for non-users to challenge or remove information about themselves.
Key Questions
Can Meta Muse read all my messages automatically?
Not based on the information available. Muse uses connectors, and access depends on the services and permissions enabled. Meta says Facebook, Instagram and Threads connect automatically when they share an Accounts Center with Muse; email and Mac Messages have separate access conditions. The exact scope of Instagram and Messenger access is not fully documented in Meta’s help pages.
Can Muse create information about people who never signed up?
WIRED and TIME reported that Muse’s instructions tell it to create and update pages about people in a user’s life, including people named in communications. Meta did not dispute the findings. The reports describe the system’s instructions; the supplied material does not independently verify how every profile is handled in practice.
How can a Muse user limit access?
Users can review and disconnect connectors, switch off model training, edit the memory file or reset Muse. On a Mac, they can check whether Full Disk Access and the Messages connector are enabled. Meta says it does not review custom connectors, so users should also inspect any they have added.
Does deleting information make Muse forget it?
Not necessarily. The source quotes Meta’s help material as saying Muse may still remember information it learned from deleted content and may forget only “to the best of its ability.” The supplied information does not specify exact retention periods or guarantee removal of learned details.
Can someone who does not use Muse stop another person’s agent from processing their messages?
The source describes fewer direct controls for non-users. WhatsApp’s Advanced Chat Privacy may limit what sits in other people’s archives, but the material does not establish that it blocks every form of access or removes information an agent has already processed.
Source: ThorstenMeyerAI.com
