🔍 Read the full analysis: Can You Control What Meta’s AI Agent Sees Without Muse? on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse AI agent can access information through connected services, including some Meta accounts and, with permission, email and Mac Messages. Reports by WIRED and TIME say its instructions direct it to maintain updated pages about people mentioned in a user’s communications, including people who never signed up. Meta says users control their own agent, but the available controls primarily belong to the Muse user, and the full scope of data use remains unclear.
Meta’s Muse AI agent can access information from services connected by its user, while investigations by WIRED and TIME report that its instructions tell it to keep updated pages about people named in messages and emails—including people who have never used Muse. The issue is drawing attention as Meta expands the agent internationally: the company announced its Singapore launch on October 27.
Muse is a personal AI agent that operates on a computer in the cloud and can perform tasks for its user, such as answering email, booking tables and shopping. Meta says each user gets a private Muse Secure VM. The company says other users’ agents cannot access that virtual computer. Muse is available through its own app, on a Mac and as a chat in WhatsApp; Meta says opening Muse in WhatsApp does not make it a reader of a person’s other WhatsApp chats.
Access depends on connectors, which link Muse to other services and form part of an AI agent’s control layer. Meta’s help information says email can be searched when connected, but the agent does not download the whole inbox unless instructed. Calendar connectors may send updates proactively. Facebook, Instagram and Threads accounts in the same Accounts Center connect automatically, according to Meta. On launch day, Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Muse also has a Messenger connector. Meta’s help pages do not spell out the full scope of those messaging connections.
Meta’s instructions, as described in the investigations, direct Muse to maintain a page for each person in its user’s life and refresh information on an hourly basis. TIME reported that these pages can be based on people mentioned in chats, messages and emails, and can include relationship details, shared interests and disputes. Meta did not dispute TIME’s findings. The company’s privacy policy says Muse may store “information about you or others,” but the exact data retained and how it is used across the service are not fully documented in the supplied material.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Risks Beyond Muse Users
The concern is that one person’s decision to connect an account may expose information about other people in their correspondence. A friend or colleague does not need a Muse account to appear in messages an agent can access, or in the person-by-person files described in the reports. That creates a gap between who controls the agent and who may be described by it.
For people who use Muse, the connectors could make an assistant more useful by giving it access to relevant messages, schedules and accounts. The same access can make personal information available to the agent when it completes tasks. For people who do not use Muse, the available options are more limited: they may be able to reduce what is shared in particular services, but they cannot directly manage another person’s Muse settings or memory.
The development also has commercial significance. The supplied source says Meta sold $25 billion in stock at $625 per share, alongside $12.5 billion in preferred stock, and that Nvidia is investing $3 billion while Meta expands its work on Muse. Those financial details do not establish how Muse uses personal information. They do show that the agent is part of a large-scale business and infrastructure effort, making clear privacy controls relevant to users and non-users alike.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Muse Connections Work
Meta launched Muse in the United States on September 8, 2026, then announced Japan on October 23 and Singapore on October 27. The source describes Japan as its first market outside North America. TIME reported more than 5 million downloads within weeks, though the supplied material does not provide the measurement method or a comparison baseline for that figure.
Some connectors require an explicit step. Meta says Mac Messages access requires the user to grant macOS Full Disk Access and turn on the connector. Users can also create custom connectors to services with a software interface; Meta warns that it does not review those custom connections. Other links, including Facebook, Instagram and Threads accounts in the same Accounts Center, are described as connecting automatically.
Reporting on Muse’s internal instructions appeared in October. WIRED reported on October 3 that security researcher Karan Joshi obtained files by asking Muse in its chat. TIME later reviewed the instructions separately and described hourly updates to files about the user and people mentioned in communications. The reports describe what the agent is instructed to do; they do not, by themselves, establish what information is retained in every user’s case.
“Muse has connectors like Instagram (incl dm’s), Threads, Facebook (incl marketplace), and Messenger.”
— Alexandr Wang, Meta chief AI officer
What the Reports Do Not Establish
The reports describe Muse’s instructions and the kinds of personal files it may maintain, but the supplied material does not establish how often those files are created, how much information is kept for each person, or how long it persists. It also does not resolve whether all connected messages are processed in the same way or only when a task calls for them. Meta’s privacy policy describes some connector data as shared proactively, while its help material says email is searched rather than downloaded wholesale unless the user asks for that.
Meta’s help information says Muse can be asked to forget information “to the best of its ability” and warns that it may still remember information learned from deleted material. The source also says TIME reported that Muse’s instructions tell it not to point out that original messages may remain visible. The full implementation of deletion, memory editing and any cross-system sharing of de-identified lessons is not clear from the available information. Meta did not dispute TIME’s findings, but that response does not independently verify every reported detail.
It is also unclear how much control non-users can exercise over profiles derived from other people’s communications. The source says WhatsApp’s Advanced Chat Privacy may limit what sits in other people’s archives, but does not provide a complete list of protections across Meta’s apps or third-party services.
Controls Users Can Check Now
Muse users can review connected services and disconnect connectors they do not want the agent to access. They can also turn off model training, which the source says is on by default, edit Muse’s memory file or reset the agent. Because some account connections are described as automatic within an Accounts Center, users should check which accounts are linked rather than assume each connector was individually added.
People who do not use Muse cannot directly change another user’s agent settings. They can review privacy controls in the services they use and, where available, restrict whether messages are shared or saved by recipients. The source specifically points to WhatsApp Advanced Chat Privacy as one option for limiting what remains in other people’s archives, while noting that it is not a universal fix.
Meta’s expansion of Muse and further detail about its connectors, memory and deletion controls will determine how users can weigh convenience against access to personal communications. Until the company provides clearer documentation, the scope of the reported profiles and the practical protections for people who never signed up remain open questions.
Key Questions
Can Muse read messages from someone who has never signed up?
It may access messages available through a Muse user’s connected services. TIME and WIRED also reported that Muse’s instructions direct it to keep pages about people mentioned in communications. A non-user does not need an account to be named in another person’s messages, but the full scope of collection and retention is not established in the supplied material.
Does opening Muse in WhatsApp give it access to all WhatsApp chats?
No. Meta says Muse in WhatsApp is a chat the user opens, not a reader of their other WhatsApp conversations. The source points to WhatsApp Advanced Chat Privacy as a way to limit what can sit in other people’s archives, but does not describe it as a complete safeguard against all information sharing.
Which accounts can connect to Muse automatically?
Meta’s help information says Facebook, Instagram and Threads connect automatically when they are in the same Accounts Center as Muse. The company’s chief AI officer has said the Instagram connector includes direct messages and that Messenger has a connector, though Meta’s help pages do not fully document what those connectors can access.
Does asking Muse to forget something delete it?
Not necessarily. Meta’s help material says Muse forgets information “to the best of its ability” and may still remember information learned from something the user deleted. The available source does not fully explain how memory deletion works across connected services or retained files.
What can Muse users do to limit access?
Users can review and disconnect connectors, turn off model training, edit the memory file or reset Muse, according to the source. They should also check which accounts share an Accounts Center, since Meta says some connections are automatic.
Source: ThorstenMeyerAI.com
