🔍 Read the full analysis: Don’t Use Muse? Meta’s AI Agent Can Still Read Your Messages. What It Sees, And How To Limit It on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Meta’s Muse AI agent can access connected accounts and messages available to the person using it, including Instagram DMs, according to Meta statements and product documentation. WIRED and TIME reported that Muse’s internal instructions direct it to maintain profiles of people mentioned in users’ communications; Meta did not dispute those findings. People who do not use Muse have limited control over what another person’s agent can access.
Meta’s Muse AI agent can read messages and other information that a user connects or makes available to it, and reports by WIRED and TIME say its instructions tell it to create and update profiles of people named in those communications. That means people who never signed up for Muse may still have information about them processed by someone else’s agent; Meta says users control what their own Muse can access.
Muse is a personal AI agent that runs in a cloud-based virtual computer and can perform tasks such as searching email, responding to messages and making bookings. Meta launched it in the United States on September 8, then announced availability in Japan on October 23 and Singapore on October 27. The company says the agent can be used through its app, on a Mac or in a WhatsApp conversation with Muse.
Meta’s help materials say users can connect email and calendars, and that Facebook, Instagram and Threads accounts may connect automatically when they share an Accounts Center with Muse. Meta Chief AI Officer Alexandr Wang said the Instagram connector includes direct messages and referred to a Messenger connector. Meta says email access lets Muse search messages but does not download an entire inbox unless the user instructs it to. A Mac Messages connector requires the user to grant Full Disk Access and turn the connector on.
WIRED and TIME reported that Muse’s instructions tell it to keep a page for each person in the user’s life and refresh information regularly. TIME said the pages can be updated hourly with details from chats, messages and emails, including relationships, shared interests and disagreements. Meta did not dispute the reports’ findings. It has said each user decides how much access Muse receives. The published material does not establish that Muse automatically reads every message in a connected service; access depends on connectors and the task or settings involved.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
When Someone Else’s Agent Reads
The privacy issue extends beyond the person who installs Muse. A message sender may not know that the recipient has connected an account to an AI agent, or that information from their conversation could be collected into a profile. The person controlling Muse can grant or remove access; people mentioned in the user’s communications do not have the same direct controls.
That distinction matters for private conversations, workplace exchanges and group chats. An agent able to search across email and social accounts may combine details shared at different times, making it easier to retrieve or summarize information about someone. Reports of regularly refreshed profiles also raise questions about how long such information persists and whether a person can correct or remove it from another user’s agent.
Meta’s help materials describe controls for Muse users, including disconnecting connectors, changing whether conversations are used to improve models, editing memory and resetting the agent. Those controls do not give a non-user a direct way to manage a profile held in another person’s account. The practical privacy boundary is therefore partly set by the choices of people in a user’s network.
Products Worth Considering
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
How Muse Gets Account Access
Muse relies on connectors to interact with other services. Meta’s product guidance says email can be searched when connected, while calendars may send updates to Muse proactively. The company’s description of connected Meta accounts says Facebook, Instagram and Threads can link automatically through a shared Accounts Center. Wang’s public statement adds that Instagram direct messages and Messenger have connectors, though the available help pages do not fully spell out the scope of those messaging integrations.
In October, WIRED reported on Muse instruction files obtained by security researcher Karan Joshi, and TIME later reviewed instructions separately. TIME described hourly updates to files about the user and people named in communications. Meta’s stated position, as reported by TIME, was that each user controls their own agent. Separately, Meta’s privacy documentation says Muse can store information about users and other people, and its help pages caution that asking Muse to forget something may not remove every detail it has learned.
Meta has also expanded Muse’s reach internationally, with Singapore announced as its latest market on October 27. The source report says Meta raised $25 billion through a stock sale priced at $625 a share and issued $12.5 billion in preferred stock; Nvidia is investing $3 billion. Those financing and chip arrangements provide business context for the agent’s expansion, but do not by themselves establish how user data is handled.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, speaking to WIRED
What Users Cannot Yet Verify
The exact scope of message access remains unclear from the public documentation. Meta’s guidance describes some connectors in detail, but does not fully explain what the Instagram DM and Messenger connectors retrieve, how much conversation history is available, or in which situations data is read proactively rather than in response to a task.
The reports describe Muse’s internal instructions, but the available information does not establish how consistently profiles are created, what information is retained in each case, or how long profiles about non-users remain stored. Meta’s statement that it did not dispute the findings is not the same as a public, technical explanation of each reported behavior. It is also unclear what remedy a person without a Muse account can use to access or remove information in another user’s agent.
Controls and Further Disclosure
Muse users can review connected services, disconnect accounts they do not want the agent to access, adjust model-training settings, edit stored memory or reset the agent. Meta’s help pages say that “forgetting” information may not remove everything Muse learned, so users should not treat that command as a guarantee of deletion. People who do not use Muse have fewer direct options and may need to ask contacts not to connect or share their communications with the agent.
The next key development is whether Meta publishes clearer details about messaging connectors, profile retention and deletion, and controls for people who are described in another user’s data. Until then, the available record confirms that Muse can access information through user-authorized connections and that two investigations reported profile-building instructions, but leaves important operational and privacy details unresolved.
Key Questions
Can Muse read messages from people who do not use it?
Potentially, if those messages are available through a Muse user’s connected account. Reports say the agent’s instructions call for profiles of people mentioned in messages. The exact scope of access depends on connectors and is not fully documented publicly.
Does Muse automatically read every WhatsApp chat?
The source material says Muse is available as a WhatsApp conversation users open; it does not establish that Muse can read their other WhatsApp chats. The claim that an agent can access messages should not be taken to mean it has access to every conversation by default.
What can Muse users do to limit access?
Users can disconnect connectors, change model-training settings, edit Muse’s memory or reset the agent. Meta’s help materials caution that asking Muse to forget information may not remove everything it learned.
Can non-users delete a profile Muse keeps about them?
No direct non-user deletion control is described in the source material. Meta says the Muse account holder controls the agent, while the process for someone else to access or remove information about themselves remains unclear.
Source: ThorstenMeyerAI.com
