🔍 Read the full analysis: Can You Limit What Meta’s AI Agent Sees In Your Messages? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse personal AI agent can use information from accounts and services connected by its user, including messages, according to Meta’s documentation and an executive statement. Reports say Muse also creates and regularly updates files about people mentioned in a user’s communications; Meta did not dispute those findings. People who do not use Muse cannot directly control another user’s agent, though some app settings can limit what is shared.
Meta’s Muse personal AI agent can access messages and other information from services connected by its user, while reports say it builds and refreshes profiles of people mentioned in those communications. Meta announced Muse’s Singapore expansion on October 27; the privacy questions matter to both users who connect their accounts and the people whose messages may be available to their agents. Meta says each user controls their agent’s access, but people who never signed up have no direct control over another person’s Muse.
Muse works through connectors that give it access to other services. Meta’s help information says connecting an email account lets Muse search messages, though it does not download the whole inbox unless asked. Calendar connectors can send updates proactively. Facebook, Instagram and Threads accounts may connect automatically when they share an Accounts Center with Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Messenger is also supported; Meta’s help pages do not detail the scope of those messaging connections.
Access to Apple’s Mac Messages requires the user to grant macOS Full Disk Access and switch on the connector. Muse can also use custom connectors, which Meta says it does not review. In WhatsApp, Meta describes Muse as an assistant a user opens in a chat, rather than a tool that automatically reads that user’s other WhatsApp conversations. The scope of access depends on the services and permissions a Muse user has enabled.
WIRED reported on instructions directing Muse to create a page for people in its user’s life. TIME separately reviewed the instructions and reported that Muse updates files about the user and people mentioned in chats, messages and emails every hour. The reports describe files containing details such as relationships, shared interests, disputes and group dynamics. Meta did not dispute TIME’s findings. The company’s privacy policy says Muse may store “information about you or others,” while a spokesperson said each user decides how much access Muse receives.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
The privacy issue extends beyond the person who installs the agent. If one person connects an account or service containing a conversation, the information available to that agent may include details about other people in the exchange. Those people may not know that a participant is using Muse, and they cannot change the permissions on that participant’s account.
That distinction matters in group chats, family conversations and work messages, where a single user’s settings can affect information about several people. It does not mean that every message is automatically read: Meta says access comes through connectors, and its descriptions indicate some data is accessed in response to tasks while other connector data may be shared proactively. The reports raise questions about how much information an agent retains and how it is used to answer later requests.
Meta’s reported business expansion adds context but does not establish a link between investment and any particular data practice. The source says Meta sold $25 billion in stock at $625 a share, alongside $12.5 billion in preferred stock, and that Nvidia plans to invest $3 billion. Meta is also deploying Nvidia chips for Muse. The figures show the scale of the companies’ commercial relationship; they do not, by themselves, prove how Muse handles an individual’s messages.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Apple iMac 2024 All-in-One Desktop with M4 Chip, 24‑inch Retina Display, 16GB Unified Memory, 256GB SSD, Silver
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Access Settings
Meta launched Muse in the United States on September 8, 2026, and described it as a personal AI agent that can perform tasks such as answering email, making bookings and shopping. Japan followed on October 23, according to the supplied source, and Meta announced Singapore on October 27. Muse runs on a cloud-based virtual computer Meta calls a Muse Secure VM; Meta says another user’s agent cannot access it. That claim concerns separation between agents, not whether a user’s own agent can access connected services.
Meta’s controls are aimed mainly at Muse users. They can disconnect connectors, switch off model training, edit the agent’s memory file or reset the agent. Meta’s help information describes a “forget” function, but says Muse may still remember information it learned from deleted material. The source also reports that the agent’s instructions may not explain that original messages can remain visible. Those points make it important to distinguish asking Muse to forget a fact from deleting the source message or all derived information.
People who do not use Muse have fewer options because they cannot adjust another person’s connector settings. The source points to WhatsApp’s Advanced Chat Privacy as one setting that can reduce what is available in other people’s archives. Its effect is limited to that app’s sharing controls; it is not a general switch that removes information already seen or stored by someone else’s agent.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, speaking to WIRED
The Limits of Meta’s Privacy Details
Several details remain unresolved. Meta’s public help pages, as described in the source, do not fully explain what information the Instagram and Messenger connectors can access, how often each connector sends data, or precisely what happens to information about non-users after it enters an agent’s memory. The reports describe hourly updates to files, but do not establish that every message or every person is processed in the same way.
Meta did not dispute TIME’s account of the instructions, but its response did not answer each question about retention, deletion, or the sharing of de-identified lessons between agents. The source also says Meta describes Muse as forgetting information “to the best of its ability” and warns that it may still remember information learned before deletion. The available material does not clarify how users can verify that a person’s details have been removed from an agent’s memory or whether deletion removes derived information across the system.
It is also unclear how Advanced Chat Privacy affects content already available to a participant’s connected services, or whether settings can prevent every form of copying or summarizing. The distinction between an agent’s access to a user’s own account and its ability to learn about other people through shared messages remains central.
Watch for Connector and Deletion Details
Readers using Muse can review which connectors are active, check whether accounts are linked through the same Accounts Center, and consider disconnecting services they do not want the agent to access. They can also review training and memory settings. These steps manage the user’s own Muse; they do not give non-users direct access to or control over another person’s agent.
The next useful disclosures would be clearer documentation from Meta about what Instagram and Messenger connectors read, what “forget” removes, and how long information about people mentioned in messages is retained. Meta’s Singapore rollout may bring further public detail about availability and controls, but the supplied material does not identify a date for additional privacy documentation or a specific policy change. Until then, the exact handling of information about non-users remains unsettled.
Key Questions
Can I stop another person’s Muse from seeing messages I sent?
There is no direct setting in the supplied information that lets a non-user control another person’s Muse. The agent’s user manages its connectors and permissions. Some app privacy settings may limit what is shared, but their effect depends on the app and the content.
Does Muse automatically read every connected inbox?
Meta’s help information says connecting email lets Muse search it, but Muse will not download the whole inbox unless the user asks. Other connectors may behave differently, and Meta’s public descriptions do not specify every detail for messaging services.
Does Muse read all of a user’s WhatsApp chats?
The source describes Muse in WhatsApp as a chat the user opens, not as a reader of the user’s other WhatsApp conversations. That does not establish how information shared through other connected services is handled.
Does asking Muse to forget something delete it?
Not necessarily. Meta’s help information says Muse may still remember information learned from deleted material. The source does not establish that asking the agent to forget a detail deletes the original message or all information derived from it.
What can a Muse user change?
A user can disconnect connectors, switch off model training, edit the memory file or reset the agent, according to the supplied material. These controls apply to that user’s Muse and do not directly change another person’s account or agent.
Source: ThorstenMeyerAI.com
