🔍 Read the full analysis: A Closer Look At What Meta’s AI Agent Can See In Messages on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse personal AI agent can access connected services, including some messages, when its user grants access or an account connection enables it. WIRED and TIME reported that Muse’s instructions direct it to maintain and refresh profiles of people mentioned in a user’s communications; Meta did not dispute TIME’s findings and says users control access. Non-users have limited direct control over information an agent may retain about them.
Meta has expanded its Muse AI agent to Singapore while reports about the service’s access to messages and its treatment of people who never signed up have drawn attention to its privacy controls. Meta says each user decides how much access Muse receives; WIRED and TIME reported that Muse’s instructions direct it to maintain profiles of people mentioned in a user’s communications, and Meta did not dispute TIME’s findings.
Muse is a personal AI assistant that runs on a computer in the cloud and can carry out tasks such as answering email, booking tables and shopping. Meta launched it in the United States on September 8, followed by Japan on October 23 and Singapore on October 27. TIME reported that it had more than 5 million downloads within weeks of launch.
The agent uses connectors to access other services. Meta’s help information says email access lets Muse search messages but does not download an entire inbox unless the user asks. Calendar connectors can send updates proactively. Meta says Facebook, Instagram and Threads connect automatically when accounts share an Accounts Center with Muse. Meta chief AI officer Alexandr Wang wrote that the Instagram connector includes direct messages and that Messenger has a connector, though Meta’s help pages do not fully specify what those connectors read.
Access to Apple’s Mac Messages app requires the user to grant macOS Full Disk Access and enable the connector, according to Meta. Muse can also be used through WhatsApp as a chat users open; the source material says this does not make Muse a reader of their other WhatsApp chats. Meta cautions that it does not review custom connectors, which users can build to link other services.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
How Message Access Affects Non-Users
The privacy question extends beyond the person who installs Muse. If a user connects an account or service containing conversations, the agent may encounter information about people who never chose to use Meta’s AI. That can include details they shared in a private message, as well as descriptions or inferences drawn from conversations.
WIRED and TIME reported that Muse’s instructions call for a page on each person in a user’s life, including people named in chats, messages and emails, with updates made hourly. TIME said those pages may cover relationships, shared interests, disagreements and group dynamics. These are reported findings about Muse’s instructions, not a public, complete accounting of what data is retained in every case. Meta says users control their agent’s access, but that does not give the people discussed in those messages the same controls.
The commercial stakes are also substantial. The source reports that Meta sold $25 billion of stock at $625 a share and $12.5 billion of preferred stock, with Nvidia investing $3 billion as the companies expand work on Muse. That financing does not establish how Muse handles individual data, but it underscores the scale of the business effort behind an agent whose usefulness depends on access to personal services.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple Mac mini Desktop Computer with M5 Pro Chip (2026)
As an affiliate, we earn on qualifying purchases.
Muse Connectors and Reported Instructions
Meta describes Muse as operating in a private virtual machine for each user, called a Muse Secure VM, and says another user’s agent cannot access it. That separation is distinct from the question of what information a user’s own agent can access through connected accounts and messages.
On October 3, WIRED reported on Muse files obtained by security researcher Karan Joshi through a conversation with the agent. The report described instructions to create pages about people in a user’s life. TIME separately reviewed the instructions three days later and reported that the agent updates files hourly. The source article says TIME’s findings were not disputed by Meta. Joshi told WIRED, “They’re trying to know you like a friend, which is honestly pretty creepy.”
Meta’s privacy policy, as cited in the source report, says Muse stores “information about you or others.” Meta also describes some connectors as sharing information proactively. The precise data available varies by connector, permissions and user actions, so a general list of connectors does not establish that every message is continuously read.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Security researcher Karan Joshi, quoted by WIRED
What Meta Has Not Specified
Meta’s public help materials, as described in the source, do not spell out exactly which messages each social connector can access, how often it reads them or how long derived information about other people remains available. The reports on hourly profile updates rely on examination of Muse’s instructions; they do not establish the contents or retention period of every user’s files.
Meta’s help pages say Muse can forget information “to the best of its ability,” while also warning that it may still remember information learned from something a user deleted. TIME reported that instructions tell Muse not to point out that original messages may remain visible. The source does not provide a full technical explanation of how deletion, memory and backups interact, or independent confirmation of the practical effect of each setting.
It is also unclear how much information is shared as de-identified “lessons,” a practice TIME reported, and what safeguards or limits apply. Meta’s statement that users control access does not answer whether people mentioned in their communications can inspect, correct or remove a profile held by someone else’s agent.
Check Access and Memory Settings
Muse users can review connected services, disconnect connectors, turn off model training, edit the agent’s memory file or reset it, according to the source report. Meta’s help language cautions that forgetting information is not necessarily the same as deleting every trace of it. Users concerned about message access should check both the permissions granted to Muse and the settings of the connected apps.
People who do not use Muse have fewer direct controls over information in another person’s agent. The source points to WhatsApp’s Advanced Chat Privacy as one measure that can limit what is retained in other people’s archives. The scope of that protection and its effect on information already accessed by an agent are not established in the material provided.
Further clarity will depend on whether Meta publishes more detailed connector documentation, explains retention and deletion practices, or responds to the questions raised by the reporting. Until then, the confirmed controls chiefly belong to the Muse user, while the treatment of people appearing in their messages remains less clearly defined.
Key Questions
Can Muse access Instagram direct messages?
Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages. Meta’s help pages, as described in the source, do not fully specify what the connector reads or how that access works.
Does Muse read every WhatsApp conversation?
The source says Muse in WhatsApp is a chat a user opens, not a reader of that person’s other WhatsApp chats. It does not establish how information shared with Muse itself is handled beyond that distinction.
What did reports say Muse remembers about non-users?
WIRED and TIME reported that Muse’s instructions direct it to create and update pages about people mentioned in a user’s communications. Meta did not dispute TIME’s findings, but the reports do not establish the details of every individual user’s stored information.
Can a person who does not use Muse delete a profile about them?
The source does not identify a direct process for non-users to inspect or delete information in another person’s Muse memory. Meta says each user controls their own agent; that is not the same as a control for people mentioned in the user’s messages.
What can Muse users do to limit access?
Users can disconnect connectors, turn off model training, edit the memory file or reset the agent, according to the source report. Meta’s help pages caution that Muse may still remember information it learned from content that was deleted.
Source: ThorstenMeyerAI.com
