🔍 Read the full analysis: Meta’s AI Agent And Message Access: What To Check And Limit on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Meta’s Muse personal AI agent can use connected services and, according to Meta’s chief AI officer, has connectors for Instagram direct messages and Messenger. Reports say its instructions direct it to maintain frequently updated profiles of people mentioned in a user’s communications; Meta did not dispute those findings and says users control their agent’s access. Users can change connectors and memory settings, but non-users have limited ways to control how their messages are handled in someone else’s account.
Meta announced Muse’s Singapore launch on October 27, expanding its personal AI agent beyond North America as reports described instructions for it to build and update profiles of people mentioned in users’ messages. Meta did not dispute the reports, and says each user controls what Muse can access; that control does not necessarily extend to people whose messages appear in a user’s connected accounts.
Muse is a cloud-based personal agent that can handle tasks such as answering email, booking tables and shopping, according to the source report. Meta says it runs in a private virtual machine for each user. The company launched Muse in the United States on September 8, expanded to Japan on October 23 and announced Singapore on October 27. TIME reported more than five million downloads within weeks; the report did not provide a comparison baseline for that figure.
Muse accesses services through connectors. Meta’s help material says email access lets Muse search a user’s email but does not download the whole inbox unless instructed. Calendar connectors may send updates proactively. Meta also says Facebook, Instagram and Threads connect automatically when they are in the same Accounts Center as Muse. Chief AI Officer Alexandr Wang said on X that connectors include Instagram direct messages and Messenger, though the source says Meta’s help pages do not document the scope of those connections in detail.
Access to Apple’s Mac Messages requires the user to grant macOS Full Disk Access and turn on the connector, Meta says. Users can also create custom connectors, but Meta warns it does not review them. In WhatsApp, the report says, Muse is a chat that a person opens; it is not described as reading that person’s other WhatsApp conversations automatically. Meta’s privacy policy, as quoted in the source, says the service may collect messages, connector data and information about the user or other people.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
How Other People’s Messages Enter Muse
The privacy issue is not limited to people who install Muse. If a user connects an account containing conversations, the agent may be able to process information about everyone in those conversations. That creates a mismatch: the account holder chooses the connection, while friends, relatives, colleagues and other correspondents may not know an agent is handling their messages.
WIRED and TIME reported that Muse’s instructions direct it to keep a page for each person in the user’s life and refresh information regularly. TIME said the files can draw on chats, messages and emails, recording matters such as shared interests, disputes and group relationships. These are findings reported by the publications, not a complete public description of how the system operates. Meta did not dispute the reporting, but its response emphasized the user’s control over access rather than explaining what controls are available to people mentioned in the data.
That distinction matters in group chats and long-running correspondence, where a person may reveal sensitive details to another human without intending them to be assembled into a searchable profile by an AI agent. The scale of adoption and the service’s integration with Meta apps could make the issue relevant even to people who never opened Muse.
Products Worth Considering
DJI Osmo Pocket 3 Filter Bundle – Vlogging Camera with 1 CMOS Sensor and 4K/120fps
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Reported Instructions
Meta describes Muse as a personal agent that operates on a cloud computer and can act on a user’s behalf. Its rollout began in the United States on September 8, followed by Japan on October 23 and Singapore on October 27. Meta calls it “the world’s first personal AI agent built for everyone,” a company characterization rather than an independently established ranking.
On October 3, WIRED reported on files that security researcher Karan Joshi obtained by asking Muse questions in its chat. The source report says the instructions included a direction to create a page for every person in the user’s life. TIME reviewed the instructions separately three days later and reported hourly updates to files about the user and people named in communications. The source notes that its account of WIRED’s findings also drew on coverage by Tom’s Guide, Gizmodo and Cybernews.
Meta’s product controls include disconnecting connectors, switching off model training, editing a memory file or resetting Muse, according to the source. The report says model training is on by default, and that Meta’s help material describes forgetting information as something Muse does “to the best of its ability.” It also says the help page acknowledges that Muse may retain information learned from content after that content is deleted.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, speaking to WIRED
What Meta Has Not Detailed Publicly
The precise scope and timing of message access remain unclear. Meta’s descriptions say some connectors operate when needed and that some data can be shared proactively, but the available material does not establish exactly which messages are read for each task, how long derived profiles are retained, or how often all connector data is processed. The reports describe hourly profile updates based on internal instructions; Meta has not publicly set out a detailed account of those processes in the source material.
It is also unclear what happens to every derived detail when a user deletes a message, disconnects a service or asks Muse to forget something. Meta’s wording acknowledges that forgetting may be imperfect. The source reports that Muse’s instructions tell it not to point out that original messages may remain visible, but does not provide a full, independently verified account of deletion behavior.
Finally, the source does not establish how a non-user can request access, correction or removal of a profile created from another person’s communications, or whether such a profile is created in every case. Meta’s broad statement that users control their own Muse does not answer those questions.
Steps Users Can Take Now
Muse users can review the connectors they have enabled and disconnect any they do not want the agent to use. They can also check the model-training setting, review or edit the memory file, and reset Muse, as described in Meta’s help material cited by the source. These actions can limit future access or alter stored information, but users should not assume that pressing “forget” guarantees every trace has been erased.
People who do not use Muse have fewer direct controls over material held in another person’s accounts. The source points to WhatsApp’s Advanced Chat Privacy as one way to limit how a chat’s content can be exported or shared, but that feature is not presented as a general opt-out from all processing by someone else’s agent. Users concerned about sensitive communications can ask contacts not to connect relevant accounts or to exclude particular conversations, while recognizing that the source does not establish a universal technical block.
Meta’s public documentation and any further responses will determine whether users and non-users get clearer details on connector behavior, retention and deletion. Until then, the practical next step is to treat connected accounts as information Muse may be able to search, and to check the settings before granting access.
Key Questions
Does Muse automatically read every WhatsApp chat?
The source says Muse in WhatsApp is a chat that users open, not a reader of their other WhatsApp conversations. It does not describe automatic access to all chats.
Can Muse access Instagram direct messages?
Meta Chief AI Officer Alexandr Wang said Muse has an Instagram connector that includes direct messages. The source says Meta’s help pages do not spell out the connector’s full scope.
What can a Muse user do to limit access?
According to the source, users can disconnect connectors, turn off model training, edit the memory file or reset Muse. Meta’s help wording cautions that forgetting information may not remove every detail already learned.
Can someone who never signed up control a profile about them?
The source does not identify a direct control that lets non-users inspect or delete a profile made from another person’s communications. Meta’s statement refers to each user’s control over their own Muse.
Source: ThorstenMeyerAI.com
