🔍 Read the full analysis: What To Know About Limiting Meta’s AI Agent’s View Of Messages on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Meta’s Muse AI agent can access information through connected services, including some Meta accounts and, with permission, Mac Messages. Reports say its instructions tell it to build and regularly update profiles of people mentioned in a user’s messages; Meta did not dispute those findings and says users control Muse’s access. Users can disconnect services, change training and memory settings, or reset Muse, but people who never signed up have limited control over information in someone else’s account.
Meta’s Muse AI agent can search information from services its user connects, and reports say its internal instructions direct it to keep regularly updated profiles of people discussed in messages and emails. The findings matter to people who have never used Muse: their information may be available to an agent through another person’s account. Meta did not dispute the reported instructions and says each user decides how much access Muse receives.
Muse is a personal AI agent that runs on a cloud-based virtual computer and can perform tasks such as answering email, booking tables and shopping. Meta says it launched in the United States on September 8, expanded to Japan on October 23 and announced a Singapore launch on October 27. The source article cites TIME’s report of more than five million downloads within weeks, but does not give a precise measurement date or methodology for that figure.
Meta’s help information describes several ways Muse may receive data. Connecting an email account lets Muse search email; Meta says it does not download the entire inbox unless asked. Calendar connectors can send updates proactively. Facebook, Instagram and Threads accounts may connect automatically when they are in the same Accounts Center as Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Messenger has a connector, though the source says Meta’s help pages do not document the full scope of those connectors.
Access to Apple’s Messages app on a Mac requires the user to grant macOS Full Disk Access and enable the connector, according to Meta’s help page. Muse can also use custom connectors, which Meta says it does not review. The source distinguishes those connections from Muse in WhatsApp: it says the agent is a chat the user opens, not a reader of that person’s other WhatsApp conversations.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Message Access Can Reach Non-Users
The privacy issue extends beyond the person who installs Muse. If an agent can search messages, the people who wrote or are mentioned in them may have their personal details processed without having an account or directly agreeing to the agent’s access. That could include relatives, coworkers and friends, depending on what a user connects and what information appears in the material the agent can access.
Reports describe the agent’s instructions as directing it to create a page for each person in the user’s life and refresh those files hourly. TIME reported that the files could include relationship history, shared interests, disputes and group dynamics. These descriptions come from reporting on Muse’s instructions, not a public, independently verified account of every profile the system creates in ordinary use. Still, they highlight a distinction in Meta’s stated controls: the account holder can manage their agent, while people whose messages or details appear in that account may have fewer direct options.
The source also describes Meta’s policy as covering information “about you or others,” and says the policy discusses connectors that may share data proactively. Readers should distinguish that policy language and the reported instructions from a claim that every message is continuously read: the available material does not establish that Muse processes all connected content at all times.
Products Worth Considering
DJI Osmo Pocket 3 Filter Bundle – Vlogging Camera with 1 CMOS Sensor and 4K/120fps
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
DJI Osmo Pocket 4 Gimbal Camera Pro Kit, 18-Piece Bundle
As an affiliate, we earn on qualifying purchases.
How Muse Gets Connected Data
Muse’s functions depend on connectors, which link the agent to other services. Meta’s stated rules vary by service: email can be searched without downloading the whole inbox by default, while access to Mac Messages requires explicit system permission and a connector setting. The source says Meta accounts in a shared Accounts Center may connect automatically, a detail users should check rather than assume they must manually add each service.
The reporting on Muse’s internal instructions came from two investigations. WIRED reported on files obtained by security researcher Karan Joshi, who asked Muse about its instructions. TIME later reviewed the instructions separately and reported that Muse updates files about the user and people named in accessible chats, messages and emails. According to the source, Meta did not dispute the findings. That is not the same as Meta publicly confirming every reported detail or explaining how the instructions operate across users.
Meta describes a “Muse Secure VM” as a private virtual computer that another user’s agent cannot access. That claim addresses separation between agents; it does not answer what information a user’s own agent can process from connected accounts. The source also reports a financing development: Meta sold $25 billion in stock at $625 a share and $12.5 billion in preferred stock, while Nvidia, whose chips Meta plans to use for Muse, is investing $3 billion. The figures establish a business connection, but do not by themselves show how that investment changes data practices.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Security researcher Karan Joshi, quoted by WIRED
What the Controls Cannot Confirm
The available material does not establish precisely which messages Muse accesses in routine use, how often each connector retrieves information, or how long information about non-users remains in an agent’s records. The source says Meta’s privacy policy describes some connector data as shared proactively, but it does not provide a full technical explanation of when that occurs.
Deletion is also not necessarily the same as removing information already learned. Meta’s help pages reportedly say Muse forgets information “to the best of its ability” and may still remember something after a user deletes it. TIME reported that Muse’s instructions tell it not to point out that original messages may remain visible. The source does not establish that every deletion request fails, or explain the full process for removing derived information.
It is also unclear what independent options non-users have to request removal of details held in another person’s Muse account, and whether Meta’s reported safeguards or memory controls apply to every connector and market. The source says WhatsApp’s Advanced Chat Privacy can limit what sits in other people’s archives, but gives no evidence that it removes information already accessed by an agent.
Steps Users Can Take Now
Muse users can review connected services and disconnect connectors they do not need, including checking whether Meta accounts are linked through the same Accounts Center. They can avoid granting Mac Full Disk Access unless they intend to use the Messages connector, and review any custom connector carefully. Meta’s help pages also describe turning off model training, editing the memory file and resetting Muse. The source says training is on by default; users should check the current setting in their own account, since options can change.
For conversations where one participant wants to limit what others can preserve, the source points to WhatsApp’s Advanced Chat Privacy. That is a measure to reduce what is kept in other people’s archives, not a guarantee that previously collected material is erased. People who do not use Muse can ask contacts not to connect or share their messages, but the source identifies few direct controls for them once information is in another person’s agent.
Meta has not, in the source material, published a detailed public accounting of how profiles of non-users are created, stored or removed. Further clarity would depend on Meta explaining the scope of connectors, memory deletion and non-user requests. Until then, the practical approach is to treat connected messages as information an agent may be able to search and to limit access at the account and conversation level.
Key Questions
Can Meta Muse read messages from someone who has never signed up?
Potentially, through another user’s connected account. Reports say Muse’s instructions cover people mentioned in chats, messages and emails that its user’s agent can access. This does not mean every non-user’s messages are available to every Muse agent.
Does Muse automatically connect to Instagram messages?
The source says Meta accounts may connect automatically when they share an Accounts Center with Muse, and Meta executive Alexandr Wang said the Instagram connector includes direct messages. The source also says Meta’s help pages do not fully document the scope of that access.
How can a Muse user limit the agent’s access?
Users can review and disconnect connectors, avoid granting permissions they do not need, turn off model training, edit the memory file or reset Muse, according to the source. Settings and connector behavior should be checked in the current account.
Does deleting a memory guarantee Muse has forgotten it?
No such guarantee is established in the source. Meta’s help information reportedly says Muse forgets information “to the best of its ability” and may still remember information after deletion.
Can a non-user remove information from someone else’s Muse?
The source does not identify a direct, comprehensive removal control for non-users. It describes WhatsApp’s Advanced Chat Privacy as one way to limit what sits in other people’s archives, but does not say it erases information already accessed.
Source: ThorstenMeyerAI.com
