🔍 Read the full analysis: Meta’s AI Agent Can Read Messages Even If You Skip Muse on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Reports by WIRED and TIME say Meta’s Muse is instructed to create and regularly update profiles of people mentioned in a user’s messages and emails, including people who never signed up. Meta says each user controls what access Muse receives, but the scope of data retention and the options available to non-users remain unclear.
Muse is a cloud-based personal AI agent that can act on a user’s behalf, including searching connected services. Meta’s help pages say users can connect email and calendar accounts, and that Facebook, Instagram and Threads may connect automatically when they are in the same Accounts Center. Meta Chief AI Officer Alexandr Wang said the agent also has Instagram connectors that include direct messages, as well as a Messenger connector; the available official documentation does not fully specify what those connectors can access.
Meta says connecting email lets Muse search messages but does not download the entire inbox unless the user asks. Access to Apple’s Mac Messages requires a user to grant macOS Full Disk Access and enable the connector. Meta also warns that it does not review custom connectors. The company describes Muse as running in a separate virtual machine for each user, and says using Muse in WhatsApp means opening a chat with the agent—not giving it access to a person’s other WhatsApp conversations.
WIRED and TIME reported that Muse’s internal instructions direct it to maintain a page for each person in a user’s life and update information based on communications it can access. TIME said those instructions include reviewing people named in chats, messages and emails and recording details such as relationships, shared interests and disputes. Meta did not dispute the reports’ findings, according to the source material. The investigations do not establish that every user’s messages are routinely read in full or that every detail in a profile is accurate.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
How Other People’s Messages Enter Muse
The issue extends beyond the person who installs the agent. If a Muse user connects communications containing other people’s messages, information about those contacts may be processed as part of the user’s interactions with the tool. That creates a privacy gap between account control and data exposure: the Muse user can choose which connectors to enable, while the people discussed in those messages may not have a direct relationship with Meta’s agent.
The practical reach depends on what a user connects and what the agent accesses to answer requests. Meta’s policy, as described in the source material, says Muse may store information about the user or others. But the reporting does not establish how often third-party profiles are used, how long their details remain stored, or whether they are used outside that person’s agent. Those distinctions matter to people deciding whether to share sensitive information in messages with friends, family or colleagues who may use connected AI tools.
Products Worth Considering
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
As an affiliate, we earn on qualifying purchases.
Muse Connectors and the Reports
Meta launched Muse in the United States on September 8, 2026, and Japan followed on October 23. Meta announced availability in Singapore on October 27, its first market outside North America, according to the source material. The company describes Muse as an assistant that can handle tasks such as email, bookings and shopping. Meta has called it “the world’s first personal AI agent built for everyone”; that is the company’s characterization, not an independently established finding.
On October 3, WIRED reported on Muse instruction files obtained by security researcher Karan Joshi, who said he was able to get the files by asking Muse in chat. TIME reviewed the instructions separately three days later, according to the source material. The reporting describes recurring updates to information about the user and people appearing in communications the agent can access. It also says agents may share de-identified lessons across the system, a point that requires more detail from Meta to understand what is shared and how it is protected.
Meta’s privacy materials and help pages describe connector access, data handling and user controls, but they do not answer every question raised by the investigations. The source also reports a $25 billion stock sale at $625 per share, $12.5 billion in preferred stock and a planned $3 billion investment by Nvidia, whose chips Meta will use for Muse. Those financial arrangements provide business context for the expansion, but they do not by themselves establish how Muse handles individual messages.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, quoted by WIRED
Retention and Non-User Controls
Key operational details remain unconfirmed. The source material does not provide a complete account of how long Muse keeps information about people who did not sign up, whether a profile is created for every person mentioned, or how often such profiles are actually consulted. The reports describe the agent’s instructions, not an audit of every user’s data or a measurement of how consistently the instructions are followed.
Meta’s help guidance reportedly says Muse may retain information it learned even after a user deletes material, and that it forgets information “to the best of its ability.” The supplied excerpt is incomplete, so the exact deletion terms and any exceptions cannot be stated here. It is also unclear what recourse a non-user has to request removal of information held through another person’s account. Meta’s general statement that users control access does not resolve those questions.
The material gives no detailed explanation of what “de-identified lessons” contain, how they are separated from individual communications, or whether the practice applies to information about non-users. The breadth of Instagram and Messenger access also remains unclear in Meta’s public documentation, despite Wang’s statement about the connectors.
What Users and Meta May Clarify
People using Muse can review connected services and disable connectors they do not want the agent to access. Meta’s controls, as described in the source material, also include turning off model training, editing the memory file and resetting Muse. Users should check the current settings and policy language in their own apps, since the available controls may differ by service and can change.
For people who do not use Muse, the source material points to options that limit what other people can keep in their own messaging archives, such as WhatsApp’s Advanced Chat Privacy. Such measures do not amount to a direct opt-out from processing by another person’s connected services, and their effectiveness depends on the app and the information involved.
The next meaningful development would be clearer documentation from Meta on the connector scope, third-party profile retention, deletion requests and the system-wide sharing of de-identified information. Until Meta provides those details—or independent testing establishes how the features work in practice—the reports describe a documented design concern, while its prevalence and effects remain uncertain.
Key Questions
Can Muse access messages from someone who never signed up?
It may process information about non-users when a Muse user connects services containing their communications. WIRED and TIME reported that Muse is instructed to create profiles of people mentioned in accessible messages. The reports do not show that every non-user’s messages are accessed.
Does Muse automatically read every Instagram or WhatsApp conversation?
The available information does not establish that. Meta’s help pages say Facebook, Instagram and Threads can connect automatically when accounts share an Accounts Center, while Alexandr Wang said Muse has Instagram DM and Messenger connectors. Meta says a Muse conversation in WhatsApp is a chat opened with the agent, not access to the user’s other WhatsApp chats.
Can a non-user tell Muse to delete information about them?
The source material does not identify a direct non-user deletion control. It describes controls available to Muse users, including editing memory and resetting the agent, and says some messaging-app settings can limit what others retain. Meta’s specific process for a non-user to request removal remains unclear.
What can a Muse user do to limit access?
Users can review and disconnect connectors, turn off model training, edit Muse’s memory file or reset the agent, according to the source material. The precise settings and their effects should be checked in Meta’s current help pages.
Source: ThorstenMeyerAI.com
