🔍 Read the full analysis: Meta’s AI Agent May See Your Messages: What You Can Do on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Meta’s personal AI agent, Muse, can use information from services connected by its user, including some messages. Reports based on Muse’s instructions say it builds and updates profiles of people mentioned in a user’s communications; Meta did not dispute those findings and says users control access. Non-users have limited direct controls, while Muse users can disconnect services, change settings, edit memory or reset the agent.
Meta has expanded its Muse AI agent to Singapore while its privacy policy and reporting about the agent’s instructions raise questions about what it can learn from users’ communications. Meta’s help pages say Muse can access data through connected services, and investigations reported that it keeps files on people mentioned in a user’s messages and emails. That can include people who never signed up for Muse.
Muse is a personal AI agent that runs on a computer in the cloud and can carry out tasks such as answering email, booking tables and shopping. Meta launched it in the United States on September 8, followed by Japan on October 23 and Singapore on October 27, according to the source material. Meta says each user has a private Muse Secure VM, which it describes as inaccessible to other users’ agents.
Access depends on the services a Muse user connects and the permissions they grant. Meta says connecting email lets Muse search messages, but it does not download the entire inbox unless asked. Calendar data can be sent to Muse proactively. Meta’s help page says Facebook, Instagram and Threads may connect automatically when accounts share an Accounts Center. Meta chief AI officer Alexandr Wang also said Muse has Instagram and Messenger connectors, including Instagram direct messages; the scope of those connectors is not fully specified in the help pages described by the source.
Mac Messages access requires the user to grant macOS Full Disk Access and enable the connector. Muse can also use custom connectors, which Meta says it does not review. The agent may therefore be able to process information about other people when a user gives it access to conversations or services containing that information. Meta’s privacy policy describes collected data as including messages, connector data and “information about you or others.”
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Beyond the Muse User
The privacy issue extends beyond the person who chooses to use Muse. A friend, colleague or family member may have their messages included in a connected account, even if they never installed the agent or agreed to have an AI system analyze their communications. When a user asks Muse to search or summarize those messages, personal details about other people can become part of the agent’s working information.
That distinction matters because the controls belong mainly to the Muse user. Users can disconnect services, adjust settings or change what Muse retains. People whose messages appear in someone else’s account generally cannot directly manage that person’s Muse settings. The source reports that WhatsApp’s Advanced Chat Privacy can limit some sharing, but it does not provide a universal way for non-users to remove their information from another person’s connected services.
There is also a practical difference between asking an agent to forget something and deleting the underlying record. Meta’s help material says Muse may still remember information it learned from data a user deleted, and describes forgetting as working “to the best of its ability.” That wording leaves a gap between a user’s request and a guarantee that all derived information has been erased.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Ninja SP151 Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
As an affiliate, we earn on qualifying purchases.
How Muse Gets Its Information
Muse’s capabilities are organized around connectors, which link the agent to other apps and services. Some require a user to take explicit steps, such as enabling Mac Messages access. Others may be activated automatically through shared Accounts Center settings, according to Meta’s help page. The source says users can also switch off model training, which is on by default, edit Muse’s memory file or reset the agent.
Two investigations described a deeper layer of memory. WIRED reported on instruction files obtained by security researcher Karan Joshi, and TIME later reviewed Muse instructions separately. The reports said the agent is directed to maintain “a page for every person in the user’s life” and update information about people mentioned in chats, messages and emails. The files reportedly cover relationships, shared interests, disputes and other details. Meta did not dispute TIME’s findings, according to the source article.
Meta’s public expansion is also paired with major financing and infrastructure plans. The source says Meta sold $25 billion in stock at $625 a share and issued $12.5 billion in preferred stock, while Nvidia said it would invest $3 billion. Meta plans to deploy Nvidia chips for Muse. Those figures do not establish how Muse handles any individual’s data, but they show the scale of the commercial and computing effort behind the service.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, speaking to WIRED
Limits of the Public Record
The source material does not establish exactly what each connector reads in every situation, how long information about non-users is retained, or whether profiles are generated for every person mentioned in communications. Meta’s help pages reportedly do not spell out the precise scope of Instagram direct-message and Messenger access, despite Wang’s statement about those connectors.
The reports describe Muse’s internal instructions, but the material provided does not independently verify how consistently the agent follows them in routine use. Meta did not dispute TIME’s findings in the account cited by the source, but its response emphasized user control rather than addressing each reported instruction. The extent to which information is shared in de-identified form across the system, and what that means for individual privacy, also remains unclear.
Users and non-users should not treat “forget” as a confirmed, complete deletion of every copy or inference. Meta’s own wording is qualified, and the source does not provide a detailed technical explanation of what remains after a request to forget or a reset.
Controls Users Can Change Now
Muse users can review connected services and disconnect any connector they do not want the agent to use. They can also turn off model training, edit the memory file or reset Muse, according to the source material. People should check account-sharing settings as well: Meta says Facebook, Instagram and Threads can connect automatically when they are in the same Accounts Center.
For Mac Messages, users can revoke Full Disk Access or switch off the connector. Users who rely on custom connectors should review what information those links expose, bearing in mind Meta says it does not review them. Anyone asking Muse to forget information should understand that Meta’s help language does not promise complete removal of what the agent may have learned.
People who do not use Muse have fewer direct options. The source points to WhatsApp’s Advanced Chat Privacy as one way to limit some use of chats, but it does not describe a general opt-out from another person’s connected email, messages or social accounts. Further clarity will depend on Meta documenting connector scope, retention and deletion practices, and on whether the company responds more specifically to the reported instructions as Muse expands to additional markets.
Key Questions
Can Muse read messages from someone who does not use it?
Potentially, through a Muse user’s connected account. If the user gives Muse access to a service containing messages, the agent may process communications that include other people. Those people do not need to have signed up themselves.
Does Muse automatically read every message?
That is not established by the source. Meta says email access allows Muse to search messages but does not download the whole inbox unless asked. Other connectors may work differently, and the reported scope of some messaging connectors is not fully documented in the material.
What can Muse users do to limit access?
Users can review and disconnect connectors, turn off model training, edit Muse’s memory file or reset the agent. They can also check Accounts Center links and revoke the permissions needed for specific connectors, such as Mac Messages access.
Does asking Muse to forget something delete it completely?
Meta’s wording does not promise complete deletion. Its help material says Muse may still remember information learned from deleted data and describes forgetting as working “to the best of its ability.”
Can non-users remove their information from someone else’s Muse?
The source describes no general control for that. Non-users may be able to limit certain sharing through features such as WhatsApp’s Advanced Chat Privacy, but the main connector and memory controls are held by the Muse user.
Source: ThorstenMeyerAI.com
