🔍 Read the full analysis: How Meta’s AI Agent Can Read Messages Even If You Don’t Use Muse on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Meta’s Muse AI agent can access information through apps and accounts its user connects, including some Meta services and, with permission, Mac Messages. WIRED and TIME reported that Muse’s instructions direct it to maintain profiles of people mentioned in users’ communications, including people who never signed up; Meta did not dispute the reports and said users control the agent’s access. The precise scope of processing, retention and options for non-users remains unclear.
Meta’s Muse AI agent can process messages and other data from services its users connect, and investigations by WIRED and TIME report that its instructions tell it to keep profiles of people mentioned in those communications. That includes people who do not use Muse, raising questions about how much control they have over information entering another person’s AI-powered records. Meta did not dispute TIME’s findings; a spokesperson said each user controls what Muse can access.
Muse is a personal AI agent that runs on a cloud-based computer and can perform tasks such as searching email or making bookings. Meta’s help information describes connectors that give Muse access to other services. The company says connecting email lets Muse search it but does not download the whole inbox unless the user asks. Calendar data can be sent proactively. Meta accounts in the same Accounts Center as Muse may connect automatically, according to the company’s help material.
Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Messenger is also supported. The company’s help pages, as described in the source material, do not spell out the full scope of those connectors. Mac Messages access requires the user to grant macOS Full Disk Access and enable the connector. Meta also permits custom connectors and warns that it does not review them. Access depends on the account holder’s connections and permissions; a person’s presence in another user’s messages does not mean that person independently authorized Muse.
WIRED reported on files that security researcher Karan Joshi said he obtained by asking Muse in chat. The reported instructions direct the agent to create a page for each person in the user’s life. TIME later reported that Muse updates files hourly for the user and people named in chats, messages and emails it has read, including information about relationships and disputes. Meta did not dispute TIME’s account. It said: “Each person stays in control of their Muse and decides how much access it gets.” That statement describes the user’s control of their own agent, not a separate consent mechanism for everyone mentioned in their communications.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
When Messages Become AI Profiles
The issue extends beyond the person who installs Muse. Private conversations routinely contain names, plans, personal histories and disagreements involving other people. If an agent turns those exchanges into persistent profiles, details shared for one conversation could be organized for later searches or summaries. That creates a privacy gap between the person granting access and the people whose information is included.
Meta’s guidance and the reported instructions describe different parts of the system: users can grant or revoke connectors, while reports say Muse may maintain information about people encountered through those sources. The source material does not establish how often such profiles are used, how accurate they are, or whether they are shared with other users. Still, the reports matter because a person who avoids AI tools may have limited ability to prevent their messages from being processed by someone else’s agent.
There is also a distinction between deleting a source message and removing information an agent may have inferred from it. Meta’s help material says Muse may retain learned information after deletion and describes its ability to forget as limited. That makes clear retention and deletion rules relevant not only to Muse users but also to people whose information appears in connected accounts.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Muse’s Connectors and Expansion
Meta launched Muse in the United States on September 8, 2026, according to the source material, and Japan followed on October 23. Meta announced its Singapore expansion on October 27. TIME reported more than five million downloads within weeks; the source does not provide a measurement method or a more precise period for that figure. Meta describes Muse as running in a private virtual machine for each user, which it says other users’ agents cannot access.
Muse can be opened in its own app, on a Mac or as a chat in WhatsApp. The source material says the WhatsApp Muse chat is a conversation users open, not a reader of their other WhatsApp chats. That distinction does not resolve what happens when a Muse user connects other accounts or sources containing messages from people who have not signed up.
The report also links Muse’s rollout to Meta’s financing and computing plans. Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock; Nvidia said it would invest $3 billion as the companies expand their work, and Meta plans to deploy Nvidia chips for Muse. Those commercial developments provide context for the agent’s growth but do not, by themselves, establish how user data is handled.
““They’re trying to know you like a friend, which is honestly pretty creepy.””
— Security researcher Karan Joshi, quoted by WIRED
Scope of Retention Still Unclear
The reports describe Muse’s internal instructions, but the source material does not establish how consistently the agent creates or updates profiles, how long those records persist, or whether people profiled through messages can access or correct them. Meta’s public explanation that users control access does not answer those questions. The exact data available through Instagram direct-message and Messenger connectors is also not fully detailed in the cited help information.
Meta’s help material says Muse may still remember information it learned after the original material is deleted and that it forgets information “to the best of its ability.” The source does not specify how this works for derived profiles, what deletion requests remove, or whether information is retained in backups or system-level records. The reported sharing of de-identified lessons across the system also needs clarification: the source does not explain what is included or how de-identification is tested.
These limits matter because the underlying reporting is not the same as a public, technical account of every data flow. Meta did not dispute TIME’s findings, but it has not supplied, in the material provided, a detailed response addressing each reported instruction or the options available to non-users.
Watch for Policy and Control Details
Readers should look for further detail from Meta on what each connector can read, how long information about third parties is kept, and how users can remove derived profiles rather than only disconnect an app. Any policy or product changes would help clarify whether “forgetting” removes information learned from messages or only stops future access to a source.
For current Muse users, Meta’s stated controls include disconnecting connectors, changing model-training settings, editing the memory file and resetting Muse. Those controls affect the user’s agent. People who do not use Muse have fewer direct options; the source material points to WhatsApp’s Advanced Chat Privacy as one way to limit what is available in other people’s archives, but does not establish that it prevents all copying or processing elsewhere.
Meta’s expansion into Singapore and its work with Nvidia are expected to support Muse’s wider availability and computing capacity, according to the source material. No timetable for additional privacy disclosures or changes to third-party controls is provided. The next meaningful development will be whether Meta publishes clearer explanations of profiling, retention and deletion as Muse reaches more users.
Key Questions
Can Muse read messages from someone who has not signed up?
It may process messages available through a Muse user’s connected accounts. WIRED and TIME reported that Muse’s instructions include profiles of people named in users’ communications. A non-user does not grant access themselves, and the exact scope of processing is not fully documented in the source material.
Does Muse automatically read all of a connected email inbox?
Meta’s help information says an email connector lets Muse search email but does not download the whole inbox unless the user asks. That is Meta’s description of the connector; it does not resolve every question about what information may be retained or derived.
Does opening Muse in WhatsApp give it access to other WhatsApp chats?
The source material says Muse in WhatsApp is a chat the user opens, not a reader of their other WhatsApp conversations. It does not establish what may happen if a user provides messages or connects other services to Muse.
Can non-users delete information Muse has about them?
The source material does not describe a direct deletion control for people who do not use Muse. Meta says users control their own agent, while its help guidance says Muse may retain information it learned even after source material is deleted.
What can Muse users do to limit access?
According to the source material, users can disconnect connectors, adjust model-training settings, edit Muse’s memory file or reset the agent. These steps govern a user’s Muse; they do not necessarily remove information held in other users’ archives.
Source: ThorstenMeyerAI.com
