🔍 Read the full analysis: Why Meta’s AI Agent May Read Your Messages Even When You Skip Muse on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Meta’s Muse agent can access information through app connectors granted by its user, including some messages and social accounts. Reports by WIRED and TIME describe Muse instructions to maintain profiles of people mentioned in those communications, including people who have never used Muse; Meta did not dispute the findings. The reports leave questions about what information persists, while non-users have limited control over other people’s Muse settings.
Reports by WIRED and TIME say Meta’s Muse personal AI agent is instructed to build and regularly update profiles of people mentioned in the user’s messages, including people who have never signed up for the service. Meta did not dispute TIME’s account and said each user controls what Muse can access, but the reporting raises a separate question: what control do people have when someone else’s agent processes communications about them?
Muse’s access depends on connectors, links between the agent and other services. Meta’s help pages say connecting email lets Muse search messages, though it does not download an entire inbox unless the user directs it to. Meta says Facebook, Instagram and Threads may connect automatically when they share an Accounts Center with Muse. Mac Messages access requires the user to grant macOS Full Disk Access and enable the connector. Meta’s policy describes some connectors as able to share data proactively.
Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Muse has a Messenger connector. The company’s help materials do not fully document what those social messaging connectors can read. Muse also has a chat interface in WhatsApp, but that is different from access to a person’s other WhatsApp conversations. Meta says the agent runs in a private virtual machine for each user; this describes separation between users’ agents, not whether people mentioned in their users’ communications are profiled.
WIRED reported on Muse instructions obtained by security researcher Karan Joshi, which direct the agent to create “a page for every person in the user’s life.” TIME later reported that Muse refreshes records hourly and may draw on chats, messages and emails to note relationships, shared interests and conflicts. TIME’s review was separate; Meta did not dispute its findings. The reports describe what the instructions tell Muse to do, but do not establish that every profile is complete or that every message is processed in every case.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Beyond the Muse User
The issue is that the person who grants access is not the only person whose information may be involved. A message often contains details about its sender and recipient, as well as other people discussed in the conversation. If an agent retains summaries or relationship notes derived from those exchanges, someone who never installed Muse may still be represented in the user’s agent records.
That distinction matters for consent and practical control. A Muse user can decide whether to connect an account, but the people on the other side of their messages generally cannot change that user’s settings. Meta’s statement that each person controls their own Muse addresses the account holder’s access choices; it does not explain what remedies are available to people discussed by that account holder’s agent.
The business stakes also form part of the story. The source reports that Meta sold $25 billion in stock at $625 per share, plus $12.5 billion in preferred stock, and that Nvidia plans to invest $3 billion while Meta expands its work on Muse. Those figures indicate substantial commercial activity around the agent and its computing needs. They do not, by themselves, show that the investment caused any particular privacy practice or that Muse’s business model requires unrestricted access.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 42-Inch S90H OLED 4K Smart TV Bundle
Dyson V8 Cyclone Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How Muse Gets Its Data
Meta launched Muse in the United States on September 8, 2026, according to the source, describing it as a personal agent that can perform tasks such as answering email, booking tables and shopping. Japan followed on October 23, and Meta announced Singapore as a market on October 27. TIME reported more than five million downloads within weeks; that is a reported download figure, not a measure of active users.
The product works through a combination of a cloud-based assistant and connections to outside services. Some access is clearly user-enabled: email search, Mac Messages and custom connectors require action by the user. Other connections may be automatic when Meta accounts share an Accounts Center, according to Meta’s help materials. Meta cautions that it does not review custom connectors. The source also says model training is on by default and that users can turn it off, though that setting is distinct from whether the agent can access connected information to perform tasks.
Meta’s privacy policy, as quoted in the source, says Muse may store “information about you or others.” That wording helps explain why the reporting has implications beyond account holders. It does not establish the exact information retained in each case, how long each type of information remains, or whether every profile instruction is followed in the same way.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, quoted by WIRED
What the Reports Do Not Establish
The reporting describes instructions and reported agent behavior, but it does not specify how consistently Muse creates these profiles, what proportion of users’ messages contribute to them, or how much detail is retained in practice. The full scope of Instagram and Messenger access also remains unclear in Meta’s public help documentation, according to the source.
It is also unclear how long information about non-users remains, whether a non-user can request deletion from another person’s Muse records, or how such a request would work across connected services. The source says Meta’s help pages describe Muse as forgetting information “to the best of its ability” and warn that it may still remember information after deletion. TIME reportedly found instructions not to highlight that original messages may remain visible. The materials supplied do not provide enough detail to establish the precise effect of a deletion or “forget” request in every case.
Meta’s response did not dispute TIME’s findings, but the source does not include a detailed technical explanation from the company or an independent audit of the reported instructions. Claims about profile creation should therefore be distinguished from confirmed details about each individual user’s data.
Settings Users Can Change
Muse users can review and disconnect connectors, turn off model training, edit the agent’s memory file or reset it, according to the source. Those actions may change what the user’s own agent can access or retain, but they are not the same as a non-user being able to remove information from someone else’s account. Anyone considering Muse should check which accounts are connected, including whether Meta services share an Accounts Center, and review the permissions requested by any custom connector.
For people who do not use Muse, the source points to WhatsApp Advanced Chat Privacy as one way to limit what can be taken out of a group chat, though it does not describe that setting as a general block on other people’s agents or on information already shared elsewhere. Meta has not, in the material provided, announced a dedicated non-user opt-out or explained a process for challenging a profile held in another person’s Muse.
The next useful developments would be a fuller description from Meta of what the Instagram and Messenger connectors access, how profile information is stored and deleted, and what options exist for people who are not Muse users. Until those points are clarified, the confirmed practical distinction remains: Muse users can manage their own access settings, while people discussed in their messages have far less direct control.
Key Questions
Can Muse access messages from someone who never signed up?
It may process information about non-users when a Muse user connects services or gives the agent access to communications involving them. WIRED and TIME reported instructions to create profiles of people named in messages. That does not mean every non-user’s messages are automatically accessible to Muse.
Does Muse read every message in a connected inbox?
Meta’s help page says connecting email allows Muse to search it, but it will not download the whole inbox unless the user tells it to. The source says the scope of Instagram and Messenger access is not fully documented in Meta’s help materials.
Does opening Muse in WhatsApp give it access to other WhatsApp chats?
No such access is established in the source. It says Muse is a chat users open in WhatsApp and distinguishes that from reading their other WhatsApp conversations.
Can a non-user delete a profile Muse keeps about them?
The source does not identify a direct non-user deletion process. Meta says users control their own Muse, while its help materials warn that the agent may retain information it has learned even after deletion.
What can a Muse user do to limit access?
According to the source, users can disconnect connectors, switch off model training, edit the memory file or reset Muse. These settings affect the user’s agent and do not necessarily remove copies or information held elsewhere.
Source: ThorstenMeyerAI.com
