🔍 Read the full analysis: The Message Access Questions To Ask About Meta’s AI Agent on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse AI agent can access information through connected services, including some messages, and reports by WIRED and TIME say its instructions direct it to maintain files about people mentioned in a user’s communications. Meta says users control their agent’s access, but people whose messages appear in someone else’s accounts have limited direct control. The scope of retention and the effect of deletion requests remain unclear.
Meta’s Muse AI agent can search information from services its user connects, while reports by WIRED and TIME say its instructions direct it to maintain files about people mentioned in the user’s messages and emails. That raises privacy questions for people who never signed up for Muse but communicate with someone who did; Meta says users control how much access their agent receives.
Muse is a personal AI agent that Meta says can carry out tasks such as answering email, booking tables and shopping. Meta launched it in the United States on September 8, 2026, then expanded to Japan on October 23 and announced Singapore availability on October 27. The source article says TIME reported more than 5 million downloads within weeks; it does not provide the measurement method or a comparison baseline.
Meta’s help information says connecting email lets Muse search messages but does not download the entire inbox unless the user asks. Calendar data can be sent to Muse proactively. Facebook, Instagram and Threads accounts may connect automatically when they are in the same Accounts Center. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and named Messenger as a connector, though the source says Meta’s help pages do not document the precise scope of those connectors.
Mac Messages access requires the user to grant macOS Full Disk Access and enable the connector, according to Meta. The company also warns it does not review custom connectors. The source says Muse’s privacy policy refers to data from connectors, messages and “information about you or others.” In WhatsApp, Muse is described as a chat the user opens, rather than an agent that reads the user’s other conversations.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Messages Can Affect Nonusers
The privacy issue extends beyond the person who installs Muse. If an agent can search communications its user can access, people who sent those messages may have details about them processed or summarized without having chosen to use the agent themselves. The source reports that Muse’s instructions call for a page for each person in the user’s life, including people named in chats, messages and emails.
That creates an important difference between control over an account and control over information about oneself. A Muse user can choose which connectors to enable and can manage the agent’s data, but a person whose message is in that user’s account may not have the same controls. The source identifies WhatsApp’s Advanced Chat Privacy as one measure non-users can use to limit what sits in other people’s archives, but it does not establish that this blocks every route by which information may reach an agent.
The commercial context also matters, but does not by itself establish how personal information is used. The source says Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock, while Nvidia is investing $3 billion as the companies expand their work. Meta plans to deploy Nvidia chips for Muse. Those financial arrangements form part of the business backdrop; they do not prove that the agent’s data practices are driven by any particular investor or financing deal.
Products Worth Considering
Apple MacBook Pro 16-inch Laptop with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 2TB SSD, Space Black
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Apple MacBook Pro 14.2-inch with M5 Max, 18-Core CPU, 20-Core GPU, 48GB Memory, 2TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
How Muse Gets Its Access
Muse works through connectors, links that let the agent use selected apps and services. Meta describes some access as task-based: for example, a user can ask Muse to search email. The source also notes that Meta’s policy describes certain connector data as shared proactively, making the timing and extent of access relevant questions for users.
On October 3, WIRED reported on Muse instruction files obtained by security researcher Karan Joshi, who asked the agent about them. The source says TIME reviewed the instructions separately three days later. TIME’s reporting described hourly updates to files about the user and people named in communications, including details about relationships, shared interests and disputes. These are findings reported by the publications, not a complete independent audit of Muse’s operation.
Meta says each user receives a private “Muse Secure VM,” a virtual computer that, according to the company, other users’ agents cannot reach. That claim concerns separation between users’ agents; it does not answer every question about how information in connected accounts is processed, retained or used to build profiles.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, quoted by WIRED
Retention and Control Questions
The available material does not fully establish which message content each connector accesses, how often it reads that content, or how long information about third parties is retained. Meta’s help pages reportedly do not spell out the scope of Instagram DM and Messenger access, while Wang publicly described those connectors. The source also says Meta did not dispute TIME’s findings, but that is not the same as a detailed public explanation of each reported instruction or its implementation.
The source excerpt on deletion is incomplete. It says Meta’s help pages describe Muse as forgetting information “to the best of its ability” and warn that it may still remember information learned from deleted material. The full policy text, the available deletion process and the distinction between stored messages and derived memories are not provided. It is also unclear how a non-user can identify, correct or remove a profile an agent may have created about them.
These limits matter when interpreting the reports: they describe instructions and reported behavior, but the supplied material does not independently verify how consistently the agent follows them in everyday use, or whether every user’s data is handled in the same way.
Watch for Clearer Privacy Controls
Users can review Muse’s connected services, disconnect connectors they do not want it to access, turn off model training, edit the memory file or reset the agent, according to the source. These steps concern the Muse user’s own setup and do not necessarily remove information already present in another person’s account.
The next points to watch are whether Meta publishes fuller documentation for message connectors, explains how reported people-profiles are retained and updated, and clarifies what deletion or reset does to information inferred from conversations. The source does not identify a scheduled policy update or response deadline. For now, the reported capabilities and Meta’s available controls should be distinguished from unresolved questions about implementation and third-party rights.
Key Questions
Can Muse access messages from people who never signed up?
It may process communications available through a Muse user’s connected accounts. The source says Meta’s chief AI officer identified Instagram direct messages and Messenger as connectors, but the precise access scope is not fully documented in the supplied material.
Does Muse automatically read every WhatsApp chat?
The source says Muse in WhatsApp is a chat the user opens, not a reader of that user’s other WhatsApp chats. It does not provide a technical description of all WhatsApp data handling.
What did WIRED and TIME report about people mentioned in messages?
The reports described Muse instructions to keep and update files about people in a user’s life, including people named in communications. The source says Meta did not dispute TIME’s findings and quoted the company saying users control their Muse.
Can someone who does not use Muse delete a profile about themselves?
The supplied material does not describe a direct process for non-users to find or delete a profile Muse may have created about them. It says non-users have fewer controls and mentions WhatsApp’s Advanced Chat Privacy as one way to limit what may be available in other people’s archives.
Does deleting a message erase what Muse learned from it?
Not necessarily, according to the source’s account of Meta’s help pages: Muse may retain information learned from deleted material. The excerpt does not include the complete policy language or explain exactly how to remove such derived information.
Source: ThorstenMeyerAI.com
