🔍 Read the full analysis: Meta’s AI Agent And Message Privacy: What Muse Users Should Know on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Meta’s Muse personal AI agent can use information from connected services, including some messages, and reports by WIRED and TIME say its instructions direct it to maintain files about people in a user’s life. Meta says users control Muse’s access, but people whose messages appear in another user’s accounts have limited direct controls. The scope of data use, deletion and protections for non-users is not fully clear.
Meta’s Muse AI agent can draw on information from services its user connects, and reports by WIRED and TIME say its internal instructions tell it to keep and regularly update files about people mentioned in messages and other communications. That raises a privacy issue for people who never signed up for Muse: their messages may be available to someone else’s agent if they are in an account or service that user connects. Meta says each user controls what Muse can access, but the people described in those records do not have the same controls.
Muse is a personal AI agent that runs on a computer in the cloud and can perform tasks for its user. Meta says its connectors can link the agent to email, calendars, Mac Messages and Meta services. According to Meta’s help information, Facebook, Instagram and Threads may connect automatically when accounts share an Accounts Center. Email access lets Muse search messages, Meta says, but does not download the full inbox unless the user asks it to. Calendar connectors can send updates proactively.
Meta chief AI officer Alexandr Wang said on X that the Instagram connector includes direct messages and that Muse also has a Messenger connector. The supplied source says Meta’s help pages do not fully document what those connectors read. Mac Messages access requires the user to grant macOS Full Disk Access and enable the connector. Meta also warns that it does not review custom connectors built by Muse.
WIRED reported on October 3 that instructions found by security researcher Karan Joshi directed Muse to create “a page for every person in the user’s life.” TIME reported three days later that Muse’s files about the user and people named in communications are updated hourly, including information about relationships and disputes. Meta did not dispute TIME’s findings in the account provided by the source. The reports concern Muse’s instructions; they do not establish that every profile contains accurate information or that every connector reads every message.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Risks Beyond Muse Users
The issue is that message privacy can extend beyond the account holder. A person who does not use Muse may still be named in emails or direct messages that a Muse user has connected. If the reports about its profile instructions are accurate, information from those conversations can be organized and retained as a reference about that person, rather than remaining only in the original exchange.
That changes the practical stakes of linking an assistant to personal accounts. A message intended for one recipient could also become material an agent can search, summarize or use to answer later questions for that recipient. Meta says the user decides how much access Muse receives; that does not give a correspondent an equivalent choice over what another person’s agent can process. The reports do not show that Muse exposes one user’s files to another user’s agent: Meta says each person has a separate Muse Secure VM, which other users’ agents cannot reach.
There is also a business and infrastructure dimension. The source reports that Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock, while Nvidia said it would invest $3 billion as the companies expand work connected to Muse. Those figures show the scale of the commercial and technology backing described by the source, but do not establish that the investment is conditional on access to personal data or that it changes Muse’s privacy practices.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Muse Connects to Accounts
Meta launched Muse in the United States on September 8, 2026, then announced Japan on October 23 and Singapore on October 27, according to the source material. Meta describes Muse as a personal agent that can answer email, book tables and shop. It can be used through its app, on a Mac or as a chat in WhatsApp. Meta says the WhatsApp Muse chat is opened separately and does not read a user’s other WhatsApp chats.
The distinction between a user’s own access and an agent’s access matters. Muse’s capabilities depend on connectors and the permissions granted to them; the source does not establish that the agent continuously reads every connected service. Meta’s privacy policy, as quoted in the source, says connectors may share data proactively and lists messages, connector data and “information about you or others” among information Meta collects. Meta’s help pages also say that deleting information does not necessarily remove what Muse has learned from it, and that Muse forgets information “to the best of its ability.”
The source says TIME reported more than 5 million downloads within weeks of launch. That is a reported download count, not a measure of active users or the number of people whose information may appear in agent files. The same source says turning off model training is available and is on by default; users can also disconnect connectors, edit memory files or reset Muse. These controls apply to Muse users, not directly to everyone mentioned in their communications.
What Muse Records and Retains
The source material does not provide the full Muse instructions, the complete connector documentation or Meta’s full responses to the reporting. It is therefore unclear exactly which messages are accessed, when they are processed, how long derived profiles remain, and whether users can inspect or remove every fact an agent has inferred about another person. The reports describe intended instructions and files examined by journalists, not a verified account of how often each function runs across all users.
Meta’s statement that users control access does not answer whether non-users can ask for information about themselves to be removed from another person’s Muse memory. The source mentions WhatsApp’s Advanced Chat Privacy as one way to limit what sits in other people’s archives, but does not establish that it blocks all copying, summaries or information already retained. It is also unclear how Meta’s stated deletion and “forget” processes work in practice, and whether the findings apply identically across countries and app versions.
Controls and Further Disclosure
Muse users can review connected services and disconnect connectors they do not want the agent to use. The source also identifies turning off model training, editing Muse’s memory file and resetting the agent as available controls. Users should check the permissions for each service separately, particularly where messages or calendars are shared. These actions may reduce future access, but the supplied information does not establish that they erase all information already derived from past conversations.
For people who do not use Muse, the immediate options described are more limited: they can consider privacy settings in the messaging services they use, including WhatsApp’s Advanced Chat Privacy, but cannot directly manage another person’s agent through their own Muse account. The next significant information would be fuller documentation from Meta on connector scope, hourly memory updates, deletion and non-user requests. Meta has not provided a timeline for such disclosures in the source material. The scope of the reported behavior and the effectiveness of the available controls remain open questions.
Key Questions
Can Muse read every message in a connected account?
Not according to the information provided. Meta says email access allows searching but does not download an entire inbox unless requested. Wang said the Instagram connector includes DMs, while the exact scope of some connectors is not fully detailed in Meta’s help pages. Access depends on the connector and permissions.
Can someone who does not use Muse be included in its records?
Potentially, if their messages or details appear in a Muse user’s connected communications. WIRED and TIME reported instructions to maintain files about people in the user’s life and people named in messages. Those reports do not establish that every non-user is profiled or that each file is accurate.
Does deleting a message erase what Muse learned from it?
Meta’s help information, as quoted in the source, says Muse may still remember information it learned after the original material is deleted and describes forgetting as happening “to the best of its ability.” The full deletion process and its limits are not detailed in the supplied material.
What can Muse users do to limit access?
Users can disconnect connectors, turn off model training, edit Muse’s memory file or reset the agent, according to the source. These controls affect a user’s Muse setup; the source does not describe an equivalent direct control for people mentioned in that user’s messages.
Source: ThorstenMeyerAI.com
