🔍 Read the full analysis: Meta’s AI Agent Can Still Read Messages: Ways To Limit What It Sees on ThorstenMeyerAI.com
Turn your quiet moments into listening time
- Thousands of audiobooks, podcasts and originals
- Listen on your phone, tablet or Echo — also offline
- Cancel anytime
TL;DR
Meta’s Muse personal AI agent can access data through connected services, including some messages, when a user grants or has enabled the relevant access. Reports based on Muse’s internal instructions say it builds and updates profiles of people mentioned in a user’s communications; Meta did not dispute those findings and says users control their agent’s access. People who do not use Muse have limited direct control over information in another person’s connected accounts.
Meta’s Muse personal AI agent can access information in connected accounts, including some messages, and may build profiles of people named in those communications, according to Meta’s product information and investigations cited by ThorstenMeyerAI.com. The development matters to people who have never used Muse: their messages and personal details may be available to another person’s agent if that person connects relevant services.
Muse is a cloud-based assistant that can perform tasks such as handling email, making reservations and shopping. Meta says access is provided through connectors. Its help information says email access lets Muse search messages but does not download an entire inbox unless the user requests it. Calendar data may be sent proactively. Meta also says Facebook, Instagram and Threads accounts can connect automatically when they are in the same Accounts Center as Muse. Meta’s chief AI officer, Alexandr Wang, said the Instagram connector includes direct messages and that Messenger is also supported, though the detailed scope of those connectors is not documented in the cited help pages.
Access to Apple’s Mac Messages requires the user to grant macOS Full Disk Access and enable the connector, according to Meta. Users can also create custom connectors; Meta warns that it does not review them. Meta’s policy says connector data may be shared proactively and identifies messages, connector data and information about other people as information it may collect. The source report says that in WhatsApp, Muse is a chat users open, rather than an agent that reads their other WhatsApp conversations.
Investigations by WIRED and TIME, as described in the source report, examined Muse instructions that direct it to keep a page on people in the user’s life and update records hourly. The files reportedly cover people mentioned in chats, messages and emails, including facts about relationships, shared interests and conflicts. Meta did not dispute TIME’s findings. A Meta spokesperson said, “Each person stays in control of their Muse and decides how much access it gets.” That statement describes the account holder’s control; it does not establish that people mentioned in the account can directly manage the agent’s access.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
The privacy issue extends beyond the person who installs the agent. If a Muse user connects an account containing conversations, the material may include information about family members, colleagues, friends and other people who never agreed to use the service. One person’s permissions can expose another person’s words to search, summaries or the agent’s memory, depending on the connector and task.
That creates a gap between who controls the tool and who may be described in its records. Meta’s cited controls give Muse users options to disconnect services, change training settings, edit memory or reset the agent. People outside the account generally cannot operate those controls themselves. The concern is particularly relevant in group conversations, where one participant’s choices can affect what an assistant can process from the shared exchange.
The source report also points to Meta’s financing and chip partnership as business context: Meta sold $25 billion in stock at $625 per share and $12.5 billion in preferred stock, while Nvidia said it would invest $3 billion. Meta is also deploying Nvidia chips for Muse. Those figures do not establish a direct link between the investment and any particular privacy practice, but they show the scale of the commercial effort behind the agent.
Products Worth Considering
BowFlex Results Series SelectTech Dumbbells
Philips Sonicare DiamondClean 9500 Electric Toothbrush with 3 Brush Heads – Black
TheraGun Relief Massage Gun – 3 Speed, Black
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Data Connections
Meta launched Muse in the United States on September 8, 2026, and expanded it to Japan on October 23, according to the source material. The company announced Singapore availability on October 27, its first market outside North America. Meta describes each user’s environment as a Muse Secure VM, a private virtual computer that it says other users’ agents cannot access. That separation does not answer what information the user’s own agent may receive through connected services.
On October 3, WIRED reported on Muse instruction files obtained by security researcher Karan Joshi after he prompted the agent. TIME reviewed instructions separately three days later. The source report says the instructions described profiles for people in a user’s life and hourly updates. TIME’s account also described de-identified lessons being shared across the system. These are findings reported by the publications, not a complete public technical specification from Meta.
Meta’s own help and policy materials provide a separate, narrower basis for understanding access: users connect services, some Meta accounts may connect automatically through Accounts Center, and the product can process information about other people. The distinction matters because the reports describe how the agent is instructed to organize information, while Meta’s public documentation describes product access and data handling at a broader level.
““They’re trying to know you like a friend, which is honestly pretty creepy.””
— Karan Joshi, security researcher, quoted by WIRED
What the Public Documentation Leaves Open
The precise scope of the Instagram direct-message and Messenger connectors remains unclear in Meta’s cited help pages. Wang’s statement that Instagram includes DMs and that Messenger has a connector is an executive statement, but the source report says Meta’s public documentation does not spell out exactly what those connectors read or when they process it.
Meta did not dispute the reported findings about Muse’s instructions, but the available material does not establish how often every profile is created in practice, what information each record contains, how long it is retained, or whether every connected user sees the same behavior. The source report also quotes Meta’s description of “forget” as working “to the best of its ability” and says deleted information may still be remembered. The full wording and technical limits of that process are not provided here. It is also unclear what practical recourse a non-user has when their information appears in another person’s agent records.
Controls Users Can Apply Now
Muse users can review and disconnect connectors, turn off model training, edit the agent’s memory file or reset it, according to the source report. They should check which Meta accounts share an Accounts Center with Muse and review any permissions granted to email, calendar, Mac Messages or custom integrations. Meta’s cited documentation says email is searchable through its connector, while Mac Messages requires both operating-system permission and an enabled connector.
People who do not use Muse have fewer direct controls over another person’s connected account. The report points to WhatsApp’s Advanced Chat Privacy as one way to limit what can be taken out of a conversation, but it does not establish that this blocks every form of copying, access or later discussion. Meta’s forthcoming product guidance or more detailed connector documentation may clarify how messages and profile records are handled. Until then, the exact behavior of some connectors and the limits of deletion remain open questions.
Key Questions
Can Muse read messages from someone who has never signed up?
Potentially, through another user’s connected account. The source report says Muse can access connected messages and that investigations found instructions to profile people mentioned in chats, emails and messages. A non-user does not need to have an account for their information to appear in another user’s communications.
Does Muse automatically connect to Instagram messages?
Meta chief AI officer Alexandr Wang said the Instagram connector includes DMs. Meta’s cited help pages do not spell out the connector’s full scope, so precisely what it reads and when remains unclear. Meta says Facebook, Instagram and Threads may connect automatically when accounts share an Accounts Center with Muse.
How can a Muse user limit the information it accesses?
The source report lists disconnecting connectors, turning off model training, editing the memory file and resetting Muse. Users can also review operating-system permissions and custom connectors. Meta warns that it does not review custom connectors.
Does telling Muse to forget something delete it completely?
Not necessarily. The source report says Meta’s help material describes forgetting as working “to the best of its ability” and warns that Muse may still remember information it learned. The material provided does not explain every retention or deletion limit.
Source: ThorstenMeyerAI.com
