🔍 Read the full analysis: What Meta’s AI Agent Can See—and Steps To Limit That Access on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse personal AI agent can access information through app connectors, including some messages, when its user grants or has account-linked access. Reports by WIRED and TIME say Muse instructions tell it to maintain files about people in the user’s life; Meta did not dispute the findings and says users control access. People who do not use Muse have limited direct controls, though some messaging privacy settings can restrict what others can share.
Meta announced its Muse AI agent in Singapore on October 27, as reporting about the service raised concerns that it can process information about people who never signed up. Meta’s help pages describe connectors that can give Muse access to selected email, calendar, Apple Messages and Meta account data; WIRED and TIME separately reported that Muse instructions tell it to maintain files on people mentioned in a user’s communications. Meta says each user controls what their agent can access, but non-users have fewer direct ways to limit that exposure.
Muse is a personal AI agent that runs on a computer in the cloud and can perform tasks for its user. Meta launched it in the United States on September 8, followed by Japan on October 23 and Singapore on October 27. The company says each user has a Muse Secure VM, a private virtual machine that other users’ agents cannot access. Meta also says people can use Muse in its app, on a Mac or through a chat with the agent in WhatsApp; that WhatsApp chat is not described as access to a user’s other WhatsApp conversations.
Access depends on connectors. Meta’s help pages say an email connection lets Muse search email, but does not download the full inbox unless the user asks. Calendar connectors may send updates proactively. Facebook, Instagram and Threads can connect automatically when accounts share an Accounts Center. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Muse has a Messenger connector, though Meta’s help pages do not spell out the scope of those connections. Mac Messages requires the user to grant macOS Full Disk Access and turn on the connector. Meta warns that it does not review custom connectors.
Reports about Muse’s internal instructions describe a broader privacy issue. WIRED reported on files obtained by security researcher Karan Joshi, and TIME later reviewed the instructions separately. They reportedly direct Muse to keep a page for each person in the user’s life and update files hourly using people named in chats, messages and emails. Meta’s privacy policy says the service can store information “about you or others.” These reports describe what the agent is instructed to do; they do not establish that every user’s communications are always read or that every person mentioned receives a complete profile.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Why Other People’s Messages Matter
The privacy issue extends beyond the person who installs Muse because one user’s connected account can contain other people’s words. A friend, relative or colleague may have no Muse account and may never have interacted with the agent, yet their messages could be available for the user’s agent to search or summarize if the relevant connector is active and the content is accessible to that user.
That creates an imbalance in control. The Muse user can change connectors and settings, while people mentioned in the user’s communications generally cannot manage that person’s agent or directly erase its files. Group chats make the boundary harder to see: a participant’s privacy choice may affect what their own account shares, but it does not necessarily control copies or summaries held by other participants.
The commercial stakes are also relevant. The source report says Meta sold $25 billion in stock at $625 per share and $12.5 billion in preferred stock, while Nvidia plans to invest $3 billion as the companies expand their work on Muse. The report says Meta will deploy Nvidia chips for the agent. Those figures show the scale of the business relationship; they do not by themselves establish that the investment determines Muse’s data practices.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How Muse Gets Its Data
Meta describes Muse as an agent that can act on a user’s behalf, including handling email and booking tasks. Its access is tied to permissions and connected services rather than to a claim that it automatically reads every device or account. The company’s documentation distinguishes between searching connected email on request and connectors that may share updates proactively. The exact behavior can vary by connector and settings.
Meta’s chief AI officer, Alexandr Wang, described Instagram direct messages and Messenger as connector sources in a post on X, according to the source report. Meta’s help pages provide more specific details for some connections than others. For instance, they describe the permissions needed for Mac Messages, but do not fully document what the Instagram and Messenger connectors can access.
Meta provides controls for people who use Muse, including disconnecting connectors, turning off model training, editing the memory file and resetting the agent. The source report says model training is on by default and that Meta’s help material describes forgetting information as occurring “to the best of its ability.” That wording means a request to forget should not be treated as proof that all information derived from a message has been erased.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, as quoted by WIRED
What Meta Has Not Specified
The full scope of Muse’s access to Instagram DMs and Messenger remains unclear from the help pages cited in the source report. Wang’s description confirms that connectors exist, but the report says Meta’s documentation does not explain precisely what data they read, when they read it or how long derived information is retained.
Meta did not dispute the findings about Muse’s instructions when responding to TIME, but the available material does not show how consistently those instructions operate across users, whether every reported profile is created in practice, or what safeguards and deletion processes apply to information about non-users. The source also provides no independent measurement of how often Muse accesses connected data. Its descriptions of reported instructions should not be read as proof that every message is continuously monitored.
The source report says Meta’s help pages explain that Muse may retain information it learned after a user deletes the original material. The full quoted passage is not supplied here, and the extent of that residual memory, how long it persists and whether a reset removes it are not established in the material provided.
Controls Users Can Check Now
Muse users can review connected services and disconnect any connector they do not need. They can check the model-training setting, inspect or edit the agent’s memory file, and use the reset option. Because access and behavior differ by service, users should check the permission details for each connector, including any custom connector; Meta says it does not review custom connectors.
People who do not use Muse cannot change another person’s agent settings. They can still limit some sharing from their own side. The source report points to WhatsApp’s Advanced Chat Privacy as a way to restrict how chat content is exported or used in other contexts. That is not a universal deletion mechanism and cannot control messages already available through another participant’s accounts or services.
Meta has not announced a new privacy control for people mentioned in Muse users’ communications in the material provided. The next developments to watch are clearer documentation of the Instagram and Messenger connectors, details on retention and deletion, and whether Meta adds controls for people whose information appears in someone else’s agent memory.
Key Questions
Does Muse automatically read every message on a user’s phone?
No such blanket access is established. Meta describes access through specific connectors and permissions. For example, Mac Messages requires Full Disk Access and an enabled connector; connected email can be searched without downloading the entire inbox unless the user asks.
Can someone who does not use Muse be included in its information?
According to reporting by WIRED and TIME, Muse instructions tell it to maintain files about people mentioned in its user’s communications. That means non-users may be represented in an agent’s information, but the available material does not establish that every person mentioned is profiled in every case.
How can Muse users limit what the agent can access?
Users can disconnect connectors, review permissions, turn off model training, edit the memory file or reset Muse. Meta’s help pages say forgetting works “to the best of its ability,” so users should not assume that deleting a source message erases every detail derived from it.
Can a non-user delete information from someone else’s Muse?
The source material does not identify a direct tool for non-users to manage another person’s agent. They may be able to limit some sharing through privacy settings in services they use, but those settings cannot necessarily remove information already accessible through another participant’s account.
Source: ThorstenMeyerAI.com
