🔍 Read the full analysis: Don’t Use Muse? Meta’s AI Agent Can Still Read Your Messages. What It Sees, And How To Limit It on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse AI agent can access information through connectors authorized by its user, including some connected messages, while reports say its internal instructions create and update pages about people mentioned in those communications. Meta says users control Muse’s access, but people whose messages are read by someone else’s agent have limited direct controls. The scope of retention and the effectiveness of deletion tools remain unclear.
Muse is a personal AI agent that runs on a cloud-based virtual computer and can carry out tasks such as answering email, booking tables and shopping. Meta says users can interact with it through its app, on a Mac or in WhatsApp. In WhatsApp, the agent is a separate chat that a user opens, not a tool that automatically reads that person’s other WhatsApp conversations.
Access depends on connectors, which link Muse to other services. Meta’s help information says an email connection lets Muse search email but does not download an entire inbox unless the user asks. Calendar connectors can send updates to Muse. Facebook, Instagram and Threads accounts may connect automatically when they share an Accounts Center with Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Muse also has a Messenger connector, though the public help pages do not fully describe what those connectors access. On a Mac, Messages access requires the user to grant Full Disk Access and enable the connector.
Reports about Muse’s internal instructions describe a wider effect on people in a user’s communications. WIRED reported on files obtained by security researcher Karan Joshi; TIME later reviewed instructions separately. The reports say Muse is directed to keep a page on people in its user’s life and update information drawn from chats, messages and email. Meta did not dispute TIME’s findings, but said each user decides how much access Muse receives.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
The privacy issue is not limited to whether a person has installed Muse. When someone authorizes access to a conversation, information about the other participants may enter the agent’s working records. That creates a difference between the person granting access and the people whose messages are included: the account holder has settings to manage, while correspondents may not know that their words are being processed by an AI agent.
This matters especially for group chats and ongoing personal correspondence, where one participant’s settings could affect information shared by several people. The source material does not establish that Muse reads every message automatically or that it has access to every app. Access depends on the services connected, permissions granted and the task being performed. But Meta’s policy also describes some connector data as shared proactively, making the precise timing and extent of processing important questions for users and their contacts.
Meta’s product and financial plans add a business dimension, though they do not establish a motive for any particular privacy practice. The source reports that Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock, with Nvidia investing $3 billion. It also says Meta plans to deploy Nvidia chips for Muse. Those figures describe the reported financing and partnership; they do not show that the investment changes the agent’s access rules.
Products Worth Considering
Apple MacBook Pro 16-inch Laptop with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 2TB SSD, Space Black
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Apple MacBook Pro 2023 14 with M3 Pro Chip, 18 GB RAM, 2 TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Access Controls
Meta launched Muse in the United States on September 8, 2026, according to the source, and expanded to Japan on October 23 before announcing Singapore on October 27. Meta describes it as “the world’s first personal AI agent built for everyone,” a company claim rather than an independently established ranking. TIME reported more than five million downloads within weeks; the source does not provide a measurement method or a comparison baseline for that figure.
The reports about people profiles followed in October. WIRED published findings based on files Joshi said he obtained by asking Muse questions. TIME reviewed Muse’s instructions three days later and described hourly updates to records about the user and people named in the agent’s accessible communications. The source says the records can include relationships, shared interests, disputes and group dynamics. These descriptions come from the media investigations, not from a complete public technical audit by Meta.
Meta’s help materials list several controls for Muse users: disconnecting connectors, turning off model training, editing a memory file or resetting the agent. Model training is described in the source as on by default. The same materials caution that Muse may remember information it learned even after a user deletes the original item, and describe its ability to forget as applying “to the best of its ability.”
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Security researcher Karan Joshi, quoted by WIRED
Retention and Message Scope
The exact scope of data access is not fully documented in the source material. Meta’s help pages describe some connectors, but do not spell out all details of the Instagram direct-message and Messenger connections cited by Wang. It is also unclear how much message content Muse processes for a particular request, how often connector data is proactively shared, or how long information about non-users remains in memory files.
Meta did not dispute TIME’s reported findings, but that is not the same as publishing a complete account of the system or independently confirming every detail of the reports. The source also says Meta’s help pages warn that Muse may retain learned information after deletion and may not forget perfectly. It does not establish what is retained in each case, whether deletion removes copies across all systems, or how non-users can request removal of information held in someone else’s agent.
The source mentions WhatsApp’s Advanced Chat Privacy as one way for a non-user to reduce what may be included in other people’s archives. It does not explain the feature’s precise effect on Muse or establish that it blocks all forms of collection through other connected services.
What Users Can Check Now
Muse users can review their connected services and permissions, disconnect any connector they do not want the agent to use, and check the memory file and training setting. They can also reset Muse, although Meta’s wording about deletion suggests that users should not assume a reset or a deleted message erases every piece of information already inferred from it.
People who do not use Muse have fewer direct controls in the material cited here. They can review privacy settings in the services they use and discuss limits on sharing with contacts who use AI agents, but the source does not identify a universal non-user opt-out. The next key development is clearer documentation from Meta on which message data each connector can access, how long information about other people is stored, and what deletion or exclusion options those people have.
Key Questions
Can Muse read messages from someone who has not signed up?
It may process messages about a non-user when a Muse user connects a service containing those messages and asks the agent to use it. The source does not show that Muse automatically reads every message or every account.
Does Muse automatically read all WhatsApp chats?
No such access is established in the source. Meta says Muse can be opened as a separate WhatsApp chat; it is not described as automatically reading the user’s other WhatsApp conversations.
What did the investigations report about people profiles?
WIRED and TIME reported that Muse’s instructions direct it to keep and update pages about people in its user’s life, using information from communications the agent can access. Meta did not dispute TIME’s findings, but the reports are not a full public technical audit.
Can a person who does not use Muse delete information in another user’s agent?
The source identifies no direct non-user deletion control for another person’s Muse. Meta lists controls for the agent’s user, while its help material cautions that Muse may retain information it learned after an item is deleted.
What can a Muse user do to limit access?
Users can review and disconnect connectors, turn off model training, edit the memory file or reset Muse. Meta’s cited guidance says forgetting works “to the best of its ability,” so those actions should not be treated as a guarantee that all learned information is erased.
Source: ThorstenMeyerAI.com
