🔍 Read the full analysis: Your Messages And Meta’s AI Agent: What You Can Limit on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse AI agent can access data through connected services, including some messages, and reporting by WIRED and TIME says its instructions direct it to maintain profiles of people mentioned in a user’s communications. Meta says each Muse user controls the agent’s access, but people whose messages are read by someone else’s agent have fewer direct controls. The scope of data retention after a user asks Muse to forget something remains unclear.
Meta announced Singapore availability for Muse on October 27, bringing its personal AI agent to another market as reports highlighted that the tool can access communications through user-connected services and may keep profiles of people mentioned in them. People do not need their own Muse account for information about them to be processed by another person’s agent, although the precise data retained and the controls available to those non-users remain unclear.
Muse is an AI assistant that runs on a computer in the cloud and can perform tasks such as answering email, booking tables and shopping. Meta says users can interact with it through its app, on a Mac or in a WhatsApp chat. In WhatsApp, Muse is a separate chat; the source material does not indicate that opening it gives the agent access to a user’s other WhatsApp conversations.
Meta’s help pages describe connectors that let Muse work with other services. A user who connects email can let Muse search it, though Meta says the agent will not download the whole inbox unless asked. Calendar data can be sent to Muse automatically. Facebook, Instagram and Threads may connect automatically when they are in the same Accounts Center as Muse. Meta AI chief Alexandr Wang said the Instagram connector includes direct messages and named a Messenger connector, but the available help-page descriptions do not fully document what those connectors read.
Access to Apple’s Mac Messages requires the user to grant macOS Full Disk Access and turn on the connector, according to Meta. Users can also create custom connectors, but Meta says it does not review them. The Muse privacy policy describes some connector data as shared proactively and lists messages, connector information and “information about you or others” among the information Meta collects.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
How Message Access Reaches Others
The privacy issue extends beyond the person who installs Muse. If an agent can read a user’s email or direct messages, it may encounter information about correspondents who never chose to use the service. Reporting on Muse’s internal instructions suggests that the agent may organize some of that information into continuing records, rather than treating each message as an isolated request. That raises a practical distinction: the Muse user controls the connection, while other people mentioned in the communications may have no direct access to that user’s settings.
The business development also gives the questions wider reach. The source material says Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock, with Nvidia investing $3 billion as the companies expand their work on Muse. Meta’s use of Nvidia chips and the investment are reported developments; they do not by themselves establish how the agent handles personal data. But the expansion and funding underscore that Muse is part of a large commercial push, making its data practices relevant to people whose communications may feed into its functions.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Reported Instructions
Meta launched Muse in the United States on September 8, according to the source material, then expanded it to Japan on October 23 and announced Singapore on October 27. Meta describes the product as a personal AI agent and calls it “the world’s first personal AI agent built for everyone.” That wording is Meta’s characterization, not an independently established finding. TIME reported that Muse had more than 5 million downloads within weeks; the report does not provide a comparison baseline for that figure.
On October 3, WIRED reported on Muse instruction files obtained by security researcher Karan Joshi by asking the agent questions in chat. The reporting said one instruction directed Muse to create “a page for every person in the user’s life.” TIME later reviewed the instructions separately and reported that Muse updates files hourly about the user and people named in chats, messages and emails it has read. The described records may include relationships, shared interests, disputes and group dynamics. Meta did not dispute TIME’s findings, according to the source material, and said each user controls how much access Muse receives.
““They’re trying to know you like a friend, which is honestly pretty creepy.””
— Karan Joshi, security researcher, quoted by WIRED
What Data Persists After Use
The available information does not specify exactly which messages are stored, how long each type of connector data is retained, or when access occurs beyond task-related use and the policy’s description of proactive sharing. Meta’s help materials say Muse may forget information “to the best of its ability” and may still remember something after a user deletes it. “Forget” is not necessarily deletion, but the source material does not establish what remains in each case or how users can verify removal.
It is also unclear how the reported hourly updates work in practice, how broadly they apply across connectors, or what safeguards govern the reported sharing of de-identified lessons across the system. Meta did not dispute TIME’s account of the instructions, but has said users decide the agent’s access. The source material does not include a detailed Meta response to each reported behavior, nor a full technical explanation of the boundaries between an agent’s private virtual machine and data held elsewhere.
Controls Users Can Change Now
Muse users can limit access by disconnecting connectors, turning off model training, editing the agent’s memory file or resetting the agent, according to the source material. Model training is described as on by default. Users should check which services are linked—especially Accounts Center connections—and review any custom connector they have added. For email, Meta says connecting an account permits searches but does not download the entire inbox unless the user directs Muse to do so.
People who do not use Muse have fewer direct options, because they cannot change another person’s connector settings or inspect that person’s agent memory. The source material points to WhatsApp’s Advanced Chat Privacy as one way to reduce what is available in other people’s archives, but it does not say this prevents every form of copying or processing outside WhatsApp. Further clarity would depend on more detailed disclosures from Meta about connector access, memory retention, deletion and the reach of its reported profiling instructions as Muse expands to new markets.
Key Questions
Can Muse read Instagram direct messages?
Meta AI chief Alexandr Wang said the Instagram connector includes direct messages. Meta’s help pages, as described in the source material, do not fully specify the connector’s scope. Instagram may connect automatically when it shares an Accounts Center with Muse.
Does Muse automatically read every connected email?
Meta says connecting email lets Muse search the account but does not download the whole inbox unless the user asks it to. The source material also says Meta’s policy describes some connector data as shared proactively, so the timing and scope of access are not fully clear.
What can a Muse user do to limit access?
Users can disconnect connectors, turn off model training, edit the memory file or reset Muse. They can also review which accounts are linked, including services connected through an Accounts Center.
Can someone who does not use Muse remove their information from another person’s agent?
The source material identifies no direct control that lets a non-user edit another person’s Muse memory. It points to WhatsApp’s Advanced Chat Privacy as a way to reduce what sits in other people’s archives, but does not establish that it blocks all processing or retention.
Does asking Muse to forget something delete it?
Not necessarily. Meta’s help materials say Muse forgets information “to the best of its ability” and may still remember information after a user deletes it. The exact retention behavior is not clear from the source material.
Source: ThorstenMeyerAI.com
