🔍 Read the full analysis: Meta’s AI Agent May Still See Your Messages: What To Know on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Meta’s Muse personal AI agent can use connected accounts and messages available to its users, and reports say its instructions tell it to maintain files about people mentioned in those communications. Meta says each user controls the access their agent receives, but people who have not signed up have limited control over information in someone else’s account. The exact scope of data access and how reliably deleted memories are removed remain unclear.
Meta announced its Muse personal AI agent for Singapore on October 27, as reports detailed instructions directing the agent to maintain information about people mentioned in a user’s chats, messages and emails. The reports raise privacy questions for people who never signed up for Muse but communicate with someone who has connected their accounts; Meta says each user controls what their agent can access.
Muse is a cloud-based assistant that can perform tasks such as searching email, managing a calendar and booking services. Meta says it operates in a private virtual machine for each user. Its access to other services comes through connectors. Meta’s help pages say email search is available when a user connects an account, while the agent does not download the entire inbox unless instructed. Meta also says calendar connectors can send updates proactively.
Meta’s documentation says Facebook, Instagram and Threads accounts are connected automatically when they share an Accounts Center with Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Messenger is supported. The source material says Meta’s public help pages do not specify the full scope of data those social connectors can read. Mac Messages requires users to grant macOS Full Disk Access and enable the connector. Custom connectors are also possible, though Meta says it does not review them.
WIRED reported on instructions obtained by security researcher Karan Joshi that tell Muse to create “a page for every person in the user’s life.” TIME later reported that Muse updates files about the user and people named in messages and emails every hour, recording details such as relationships, shared interests and disagreements. Meta did not dispute TIME’s findings, according to the source report. These are reports about the agent’s instructions; they do not establish that every possible detail is accurate or that every message is continuously read.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Beyond the Muse Account
The central issue is that one person’s decision to connect an account may expose information about people who did not make that choice. A message can include personal details about its sender, recipients and others mentioned in the conversation. If an agent stores summaries or relationship notes derived from that content, those people may have little direct say over how their information is retained or used.
That matters as Meta expands Muse to new markets and promotes it as an assistant that can act across services. The more useful an agent becomes through access to email and social accounts, the more sensitive the information it may encounter. Meta’s policy language, as described in the source material, includes “information about you or others”; the practical scope of that phrase and the safeguards for non-users deserve close scrutiny.
The source also describes a major financing and infrastructure backdrop: Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock, while Nvidia said it would invest $3 billion. Nvidia supplies chips Meta plans to deploy for Muse. That investment does not establish that the financing is specifically earmarked for Muse, but the partnership shows the scale of resources behind Meta’s AI expansion.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Dyson Car+Boat Cordless Handheld Vacuum
Samsung 42-Inch S90H OLED 4K Smart TV Bundle
As an affiliate, we earn on qualifying purchases.
Muse Connectors and Reported Instructions
Meta launched Muse in the United States on September 8, according to the source material. Japan followed on October 23, described as its first market outside North America, and the company announced Singapore on October 27. TIME reported more than 5 million downloads within weeks; the source does not give a precise measurement window or comparison baseline for that figure.
Meta presents Muse as an agent that can act for a user from a computer in the cloud. People can interact with it through its app, on a Mac or through a Muse chat in WhatsApp, according to Meta. The source stresses that opening Muse in WhatsApp is not the same as giving it access to a user’s other WhatsApp chats. It also says WhatsApp’s Advanced Chat Privacy can limit how messages are used in other people’s archives, although the material does not detail exactly how that protection interacts with Muse.
Two separate media reports form the basis for the concerns about personal profiles. WIRED reported on files Joshi elicited by asking Muse questions in chat; TIME reviewed the agent’s instructions separately three days later. The source says Meta did not dispute TIME’s findings and quoted a spokesperson emphasizing user control. The documents and reports describe intended behavior, not an independent audit of every Muse account or a verified count of people profiled.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, quoted by WIRED
What the Reports Do Not Establish
The available material does not establish how often Muse accesses each connected source, what content is retained in each case, or how long profiles about other people remain stored. Meta’s documentation distinguishes between searches requested by a user and connectors that may share data proactively, but the source does not provide a full account-by-account record of when information is read.
It is also unclear how accurate the reported profiles are, whether the hourly updates apply in all circumstances, and how reliably a request to forget or delete information removes derived details. Meta’s help pages say Muse forgets information “to the best of its ability” and warn that it may still remember something after deletion, according to the source. The reports do not independently verify the behavior across all users or versions of the service.
Meta’s stated control applies to the person operating Muse. The source material does not identify a direct way for a non-user to inspect or delete information about themselves inside another person’s agent. It also does not provide a detailed explanation of the reported sharing of de-identified lessons across the system or how those lessons are screened for identifying information.
Controls Users Can Change Now
Muse users can review and disconnect connectors, turn off model training, edit the agent’s memory file or reset it, according to the source material. Because connector access differs by service, users should check each connected account and the permissions granted at the operating-system level. Meta’s own pages say email search does not ordinarily download a whole inbox unless the user tells Muse to, but the source advises treating access and retention as separate questions.
People who do not use Muse have fewer direct controls. They can consider limiting what they share in communications that may be accessible to someone else’s connected accounts; for WhatsApp group conversations, the source points to Advanced Chat Privacy as one available restriction. The source does not establish that this prevents every form of information from being seen, summarized or remembered by another user’s agent.
Further clarity depends on Meta publishing more detail about connector behavior, retention, deletion of derived memories and options for people who are not Muse users. The company has not, in the source material, announced a new non-user control or a timetable for such changes. Until those details are available, the documented permissions and the reported agent instructions should be understood separately from claims about how every account behaves in practice.
Key Questions
Can Muse read messages from someone who has never signed up?
Potentially, if those messages are available through an account or connector used by a Muse user. Meta’s chief AI officer said the Instagram connector includes DMs, and reports say Muse’s instructions cover people named in messages. The exact access and retention behavior is not fully documented in the source material.
Does Muse automatically read every WhatsApp conversation?
The source material says a Muse chat inside WhatsApp is a conversation users open with the agent, not access to their other WhatsApp chats. It does not support the claim that Muse automatically reads all WhatsApp messages.
What can a Muse user do to limit access?
According to the source, users can disconnect connectors, turn off model training, edit Muse’s memory file or reset it. They should also review permissions for individual services, including macOS Full Disk Access for the Mac Messages connector.
Does telling Muse to forget something delete it completely?
That is not guaranteed by the information provided. Meta’s help pages say Muse forgets information “to the best of its ability” and may still remember information after deletion, so the source does not support treating “forget” as complete erasure.
Can a non-user remove information about themselves from someone else’s Muse?
The source material describes no direct tool for a non-user to inspect or remove information in another person’s agent. It points to limiting what is shared in other people’s archives, including WhatsApp Advanced Chat Privacy, as a possible measure, but does not say this removes all existing information.
Source: ThorstenMeyerAI.com
