🔍 Read the full analysis: Message Privacy And Meta’s AI Agent: What Non-Muse Users Should Know on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse personal AI agent can read some connected accounts and messages when its user grants access or links eligible Meta accounts. Reports by WIRED and TIME say Muse’s instructions include maintaining information about people mentioned in users’ communications; Meta did not dispute the reports and says users control their agent’s access. People who do not use Muse have limited direct controls over information held in another person’s account.
Meta’s Muse agent can access certain connected accounts and communications, and reports by WIRED and TIME say its instructions direct it to keep information about people named in those messages, including people who never signed up. Meta did not dispute TIME’s findings and says each user controls what Muse can access, leaving non-users with few direct ways to control information about them held in someone else’s agent.
Muse is a personal AI agent that runs on a cloud-based virtual computer, according to Meta. The company says it can perform tasks such as answering email, booking tables and shopping. Meta launched it in the United States on September 8, expanded to Japan on October 23, and announced Singapore availability on October 27. TIME reported that Muse had more than 5 million downloads within weeks; the source material does not provide a more precise measurement window or an independent confirmation of that figure.
Muse uses connectors to work with other services. Meta’s help information says an email connector lets Muse search email, though it does not download an entire inbox unless instructed. Meta says calendar information can be sent to Muse proactively. Facebook, Instagram and Threads accounts may connect automatically when they share an Accounts Center with Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and named Messenger as a connector, but Meta’s help pages do not detail the scope of those messaging connections.
Access to Apple’s Mac Messages app requires the user to grant macOS Full Disk Access and enable the connector, Meta says. Meta also warns that it does not review custom connectors. In WhatsApp, the source says, Muse is a separate chat users open; that is distinct from access to a user’s other WhatsApp conversations. Meta’s privacy policy says collected information can include messages, connector data and information about other people.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Why Other People’s Messages Matter
The privacy issue extends beyond the person who installs Muse because messages involve more than one person. If a user gives the agent access to communications, those messages may contain details about family members, coworkers and friends who have no Muse account and did not make the connection decision. The source reports that Muse’s instructions include keeping pages on people in a user’s life and refreshing information periodically.
That creates an important distinction between account control and personal control. A Muse user can decide which connectors to enable, but people whose messages appear in the connected material generally cannot change that person’s settings. They may be able to limit what future conversations or shared archives contain, but that does not necessarily remove material already available to the agent.
The commercial backdrop is also relevant, though it does not establish how data is used in practice. Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock, according to the source. Nvidia, whose chips Meta plans to deploy for Muse, said it would invest $3 billion. Those figures frame a major business and infrastructure commitment; they do not by themselves prove a particular privacy practice or motive.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
How Muse Gets Connected
Meta describes Muse as a personal agent that acts for a user, rather than as a conventional chat tool alone. Users can interact with it through its app, on a Mac, or through a Muse chat in WhatsApp, according to Meta. The company says each user receives a Muse Secure VM, a private virtual machine that other users’ agents cannot access. That describes separation between agents, but does not answer every question about how information within a user’s own connected accounts is processed or retained.
The reporting on people profiles came from two investigations. WIRED reported on October 3 that security researcher Karan Joshi obtained Muse instruction files by asking the agent in chat. TIME later examined the instructions separately and reported that Muse updates files hourly about the user and people mentioned in chats, messages and emails it has read. The reported profiles cover details such as relationships, shared interests and disputes. The source says Meta did not dispute TIME’s findings.
Meta’s help pages describe controls for Muse users, including disconnecting connectors, turning off model training, editing a memory file and resetting the agent. The source says model training is on by default. Meta also cautions that after a user deletes information, Muse may still remember information it learned from it, and says it forgets information “to the best of its ability.” These controls belong to the Muse user, not automatically to everyone mentioned in that user’s communications.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, speaking to WIRED
Limits of the Available Privacy Details
The public information described in the source does not fully specify which messages are read, how often, or what is retained for every connector. Meta’s help pages reportedly do not spell out the scope of Instagram DMs and Messenger access, while an executive has said those services have connectors. The source also does not establish whether every reported profile instruction operates identically for every user or account.
Meta’s statement that users control their agent’s access does not resolve how non-users can request correction or deletion of information about them inside another user’s Muse account. The source notes that Meta says deletion may not erase what Muse learned and that TIME reported instructions not to point out that original messages may remain visible. The precise retention and deletion process, including what happens to derived information, remains unclear from the material provided.
The source reports that WhatsApp’s Advanced Chat Privacy can help limit what is kept in other people’s archives, but it does not explain the feature’s exact effect on information already accessed by Muse through other connectors. Readers should not treat that setting as confirmation that existing agent memories or summaries will be removed.
What Users Can Change Now
Muse users can review connected services and disconnect access they do not need, then check the agent’s memory controls. The source lists turning off model training, editing the memory file and resetting Muse as available steps. Because connector behavior differs, users should check the settings and help details for each service rather than assume that one change disables every connection.
People who do not use Muse have fewer direct options. They can consider limiting sensitive details in future messages and using available privacy controls in shared services, including WhatsApp’s Advanced Chat Privacy where appropriate. Those steps may affect future sharing or archiving, but the source does not establish that they erase material already available in another person’s account.
The next substantive developments to watch are clearer documentation from Meta about the scope of messaging connectors, how long profiles and derived information persist, and what deletion means for people mentioned in a user’s communications. Meta’s announced Singapore rollout also expands the service’s availability, but the source provides no further schedule or country-by-country privacy details.
Key Questions
Can Muse read messages from someone who never signed up?
Potentially, through another user’s connected accounts. The reports say Muse instructions cover people mentioned in chats, messages and emails that the user’s agent can access. That does not mean Muse can independently access every non-user’s account.
Does Muse automatically connect to Instagram messages?
Meta says Facebook, Instagram and Threads may connect automatically when they share an Accounts Center with Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages, but the help-page details described in the source do not specify the full scope.
Does deleting a message erase what Muse learned from it?
Not necessarily. Meta’s help information says Muse may still remember information it learned from deleted material and describes forgetting as working “to the best of its ability.” The exact handling of derived information is not fully explained in the source.
What can a non-Muse user do?
A non-user has limited direct control over another person’s Muse settings. They can limit sensitive information in future communications and use available controls in shared apps, but the source does not confirm that these steps delete information already held in another user’s agent.
Source: ThorstenMeyerAI.com
