🔍 Read the full analysis: A Look At Meta’s AI Agent’s Access To Messages And Your Options on ThorstenMeyerAI.com
TL;DR
Meta’s Muse personal AI agent can access data through app connectors, including some messages, when its user enables or has connected those services. Reports based on Muse’s internal instructions say it creates and regularly updates profiles of people mentioned in a user’s communications; Meta did not dispute those findings and says users control access. Muse users have controls over connectors, memory and training, while people who have not signed up have fewer direct options.
Meta’s Muse AI agent can search or use information from connected services, including messages, when its user gives it access, while people who communicate with that user may have information about them processed without signing up for Muse themselves. An October 28 report reviewing Meta’s stated connector features and investigations by WIRED and TIME says Muse’s instructions direct it to maintain regularly updated pages about people in a user’s life; Meta did not dispute TIME’s findings and says each user controls what the agent can access.
Muse is a personal AI agent that runs on a computer in the cloud and can carry out tasks for a user. Meta says it operates in a private virtual computer, and that another user’s agent cannot access that environment. The service launched in the United States on September 8, followed by Japan on October 23 and Singapore on October 27, according to the source material.
Meta’s help information says connecting an email account lets Muse search email, but does not download an entire inbox unless the user directs it to. Calendar connectors can send updates proactively. Facebook, Instagram and Threads may connect automatically when accounts share an Accounts Center with Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Muse has a Messenger connector, though the source says Meta’s help pages do not document the full scope of those connectors. Mac Messages access requires the user to grant macOS Full Disk Access and enable the connector.
Investigations raise a separate concern about information concerning people who have not signed up. WIRED reported on Muse instructions obtained by security researcher Karan Joshi, and TIME later reviewed instructions that reportedly tell Muse to create pages about people mentioned in chats, messages and emails and update them hourly. The source says Meta did not dispute TIME’s findings. It also reports that Meta’s privacy policy covers information “about you or others.”
According to the source’s account of Meta help pages, Muse users can disconnect services, switch off model training, edit a memory file or reset the agent. Deletion may not erase information already learned: Meta’s help wording says Muse may still remember deleted information and that it forgets “to the best of its ability.” People who never use Muse do not have equivalent controls inside someone else’s account.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
How Other People’s Messages Are Affected
The privacy issue extends beyond what a Muse user chooses to tell the agent. If a user connects an inbox or messaging service, other people’s words in that account may become available to the agent as part of the user’s communications. That does not mean Muse can independently enter every contact’s account: the described access depends on the connected services and permissions granted by its user.
The imbalance is in the controls. A Muse user can adjust connectors and memory, but a person whose messages appear in that user’s accounts may not be able to inspect or erase the resulting information. This distinction matters for private conversations, group chats and work communications, where participants may not know that an AI agent can search or retain details from a recipient’s account.
The source also links Muse’s rollout to Meta’s financing and its expanding work with Nvidia. It reports a $25 billion stock sale at $625 a share, $12.5 billion in preferred stock and a $3 billion Nvidia investment. Those financial details do not establish how Muse handles data, but they show the commercial stakes around the service’s expansion. The article’s suggestion that its business case depends on deep access is interpretation, not a confirmed statement of company strategy.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 48-Inch S90H OLED 4K Smart TV (2026)
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
Muse Connectors and the Rollout
Muse works through connectors that link it to services and allow it to act on a user’s behalf. Meta describes the agent as available through its app, on Mac and in WhatsApp. In WhatsApp, the source says, Muse is a chat the user opens; it is not described as a reader of all the user’s other WhatsApp conversations.
Meta says email search does not automatically require downloading an entire inbox, while calendar connectors may send changes without a separate prompt. For Facebook, Instagram and Threads, the source describes automatic connection when accounts share an Accounts Center. It says custom connectors can also be built, but Meta warns that it does not review them. These differences mean access depends on the service, the connector and the permissions involved; “connected” does not necessarily mean every message is continuously read.
Meta called Muse “the world’s first personal AI agent built for everyone,” according to the source. TIME reported more than five million downloads within weeks of launch. That figure is a reported download count, not a measure of active users, and the source provides no baseline for comparison.
„They’re trying to know you like a friend, which is honestly pretty creepy.“
— Karan Joshi, security researcher, quoted by WIRED
What Meta Has Not Specified
The exact scope of message access remains unclear. Meta’s public help pages, as described in the source, do not spell out what the Instagram and Messenger connectors can read or how much information they retain. Wang’s statement that Instagram access includes direct messages is an executive statement, not a full technical description of the connector.
The source says Meta did not dispute TIME’s account of Muse’s instructions, but does not provide a detailed company explanation of how the reported people-pages are used, how long they persist, or whether users can see every profile about third parties. It is also unclear how the system handles group conversations, deleted messages and information that a contact asks a Muse user to remove.
Finally, a report that an agent can access information through a user’s connected account should not be read as proof that Muse automatically reads every conversation or that every contact is profiled in the same way. The source describes connector-dependent access and reported instructions, but does not establish the frequency or outcome for each user.
Controls Users Can Change Now
Muse users can review connected services and disconnect any connector they do not want the agent to use. They can also switch off model training, edit the agent’s memory file or reset Muse, according to the source’s summary of Meta’s controls. Because Meta says forgetting is not guaranteed to remove everything learned, users should not assume that deleting a message or memory entry fully erases its influence.
People who do not use Muse have fewer direct options. The source points to WhatsApp’s Advanced Chat Privacy as one way to limit what can be carried out of certain chats, but it does not describe that setting as a universal block on information a recipient can already access. Users concerned about a conversation appearing in another person’s agent can ask that person to disconnect the relevant service or remove information from their Muse memory.
The next material development would be clearer documentation from Meta on what Instagram and Messenger connectors access, how reported profiles of third parties are stored and updated, and what deletion does in practice. Until then, the distinction remains: account holders have settings for their own agents, while people discussed in their communications have limited control over what those agents may infer or retain.
Key Questions
Can Meta’s Muse access Instagram direct messages?
Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages. The source says Meta’s help pages do not give a full account of the connector’s scope, so the exact access and handling remain unclear.
Can Muse read every WhatsApp chat?
The source describes Muse in WhatsApp as a chat the user opens, not as a reader of all their other WhatsApp conversations. It does not establish that Muse can automatically access every chat.
What can a Muse user do to limit access?
According to the source’s summary of Meta’s controls, users can disconnect connectors, switch off model training, edit Muse’s memory or reset the agent. Meta’s help wording cautions that Muse may still remember information that has been deleted.
Can someone who has not signed up for Muse remove information about themselves?
The source describes no equivalent direct control for non-users over another person’s Muse. They may be able to limit what is shared in some services or ask the account holder to disconnect a connector or remove information from memory.
Source: ThorstenMeyerAI.com
