🔍 Read the full analysis: What Can Meta’s AI Agent Read Without Muse—and How Can You Limit It? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse AI agent can access data through connected services, including email, calendars and Meta apps, subject to the user’s settings and task. Reports by WIRED and TIME say Muse instructions direct it to maintain and update profiles of people mentioned in a user’s communications; Meta did not dispute the findings. Muse users can limit access through connector, training and memory settings, while people who do not use Muse have fewer controls over information in someone else’s account.
Meta announced Muse’s expansion to Singapore on October 27, while reporting by WIRED and TIME described instructions for the AI agent to maintain profiles of people named in a user’s messages and emails. The reports raise a privacy issue for people who never signed up: information they shared with a Muse user may be processed through that user’s connected accounts, though the scope depends on the connectors and permissions enabled.
Muse is Meta’s personal AI agent, which can work with connected services to handle tasks such as searching email or making bookings. Meta’s help pages say users can connect email, calendars and Mac Messages; Facebook, Instagram and Threads may connect automatically when they are in the same Accounts Center as Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Messenger also has a connector. The help pages do not spell out the full scope of those social-app connections.
Meta says connecting email allows Muse to search messages but does not download the entire inbox unless the user directs it to. A calendar connector may send updates to Muse proactively. Mac Messages access requires the user to grant macOS Full Disk Access and enable the connector. Meta also allows custom connectors, while warning that it does not review them. In WhatsApp, Meta describes Muse as a chat users open; the supplied material does not establish that Muse can read a person’s other WhatsApp chats just by being available there.
WIRED reported on October 3 that instructions in Muse told it to keep “a page for every person in the user’s life.” TIME later reported that Muse updates files hourly on the user and people mentioned in the chats, messages and emails it has accessed. The reports describe details such as relationships, shared interests and disputes. Meta did not dispute the findings, and said each user controls how much access Muse receives. The reports concern Muse’s internal instructions; they do not establish that every profile contains accurate or complete information.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Beyond the Muse User
The concern extends beyond the person who installs the agent. Messages involve other people, and a user who links an account may make those communications available for Muse to search or process. That can include someone who has not agreed to use Meta’s agent and may not know that details about them could be organized in a profile.
Control is not evenly shared. A Muse user can change their own connectors and settings, but a person whose messages appear in that account generally cannot directly edit the user’s agent or its memory. The distinction matters for private conversations, group chats and shared correspondence. It also makes the practical reach of Muse dependent on what its users connect and what data their accounts contain—not solely on how many people use the agent.
Meta’s policy says Muse can store information about “you or others.” The reports also describe agents sharing de-identified lessons across the system, but the supplied material does not explain what those lessons contain or how effectively they are separated from identifiable information. Those limits make it difficult for outsiders to assess the full privacy impact.
Products Worth Considering
Apple MacBook Pro 16-inch Laptop with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 2TB SSD, Space Black
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Data Connections
Meta launched Muse in the United States on September 8, then introduced it in Japan on October 23 and announced Singapore on October 27. Meta describes it as a personal agent running on a cloud-based “Muse Secure VM,” which the company says other users’ agents cannot access. That security claim concerns access between agents; it does not by itself answer what information Muse can process within the account of the person using it.
The agent’s capabilities depend on connectors, or links to outside services. Meta’s documentation says some data is accessed when a task requires it, while its privacy policy also describes connectors that can share data proactively. Meta’s listed collection categories include messages, connector data and information about other people. The source reports that TIME cited more than 5 million downloads within weeks, but does not provide the exact measurement window or a comparison baseline, so the figure cannot establish a rate of growth.
Meta says each user decides how much access Muse gets. That user-level control is central to the company’s explanation, but it does not give people mentioned in the user’s communications the same direct controls.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Security researcher Karan Joshi, quoted by WIRED
The Scope of Profiles and Deletion
Several details remain unresolved. Meta’s public documentation does not fully describe what the Instagram and Messenger connectors can read, how often data is accessed, or how long information about people other than the user is kept. The source material says Meta did not dispute the reported instructions, but it does not include a detailed company explanation of how the profiles work in practice or whether they are created for every person mentioned.
Deleting data or asking Muse to forget information may not remove every derived memory. Meta’s help information says Muse forgets information “to the best of its ability” and warns it may still remember information learned from deleted material. The source also reports that Muse’s instructions discourage it from pointing out that original messages may remain visible. The exact retention and deletion behavior is not clear, and claims about what the agent remembers should not be treated as proof that every deleted item remains accessible.
Settings Users Can Change Now
Muse users can review connected services and disconnect any they do not want the agent to access. They can also turn off model training, which the source says is on by default, edit the memory file or reset Muse. Meta’s own help pages should be checked for the current setting names and effects, since controls can change as the product expands. Users should take particular care with custom connectors: Meta says it does not review them.
People who do not use Muse have fewer direct options if their information is in another person’s account. The source points to WhatsApp’s Advanced Chat Privacy as one way to limit what sits in other people’s archives. In shared chats and other services, users can also ask contacts not to connect or share particular conversations, but that does not provide a technical guarantee that existing copies or summaries will be removed.
Meta’s rollout in additional markets will put these controls and its documentation under closer scrutiny. The next useful details would be a fuller account of which data each connector can access, how profiles of other people are stored and updated, and what deletion removes. Until Meta provides that detail, the practical privacy limits remain partly dependent on the settings of the Muse user.
Key Questions
Can Muse read messages from someone who does not use it?
It may process messages available through a Muse user’s connected accounts. The reports describe profiles of people mentioned in chats, messages and emails accessed by the agent. The scope depends on the user’s connectors and permissions; the source does not show that Muse can access another person’s account independently.
Does opening Muse in WhatsApp give it access to all WhatsApp chats?
The supplied material says Muse is a chat users open in WhatsApp and does not establish that it can read their other chats merely because it is available there. Meta’s documented connector and access details should be checked for the specific feature being used.
How can a Muse user reduce the agent’s access?
Users can review and disconnect connectors, turn off model training, edit Muse’s memory file or reset the agent. They should also check permissions granted by the operating system, including Full Disk Access for Mac Messages.
Does asking Muse to forget information delete it?
Not necessarily. Meta’s help information says Muse forgets information “to the best of its ability” and may still remember details learned from deleted material. The precise effect of deletion on stored or derived information is not fully clear in the supplied material.
Can a non-user remove a profile Muse has made about them?
The source material does not identify a direct control for non-users to inspect or delete a profile in someone else’s Muse account. Their options are limited compared with the account holder’s, and depend partly on what the Muse user chooses to connect and retain.
Source: ThorstenMeyerAI.com
