🔍 Read the full analysis: Meta’s AI Agent And Your Messages: An Access Checklist on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s personal AI agent, Muse, can access information through connected services, including some messages, depending on the user’s permissions and settings. Investigations reported that its instructions include keeping updated profiles of people mentioned in a user’s communications; Meta did not dispute those findings and says users control Muse’s access. Non-users have limited direct control over what another person’s agent can process.
Meta announced its Muse personal AI agent for Singapore on October 27, expanding the service beyond North America as reports examined how it handles messages and information about people who never signed up. Meta says users choose how much access Muse receives, while its privacy policy says the service may collect messages, connector data and information about other people.
Muse works through connectors that give it access to other services. Meta’s help information says email access lets Muse search messages but does not download an entire inbox unless the user directs it to do so. Calendar connectors may send updates proactively. Facebook, Instagram and Threads accounts can connect automatically when they share an Accounts Center with Muse. Meta Chief AI Officer Alexandr Wang has said the Instagram connector includes direct messages and that Messenger is supported; the available help pages do not detail the scope of those message connections.
Access to Apple’s Messages app on a Mac requires the user to grant Full Disk Access in macOS and enable the Messages connector, Meta says. Users can also create custom connectors, but Meta warns it does not review them. Meta describes Muse as operating in a private virtual machine for each user. In WhatsApp, the agent is a chat a person opens; the source material does not establish that this gives Muse access to that person’s other WhatsApp conversations.
Separate reporting by WIRED and TIME examined Muse instructions that direct it to maintain a page about people in its user’s life and refresh information regularly. TIME reported that the pages can draw on people named in chats, messages and emails. Meta did not dispute the findings. A spokesperson said, “Each person stays in control of their Muse and decides how much access it gets.” That addresses the account holder’s choices, but leaves questions about people whose details appear in those communications.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
How Message Access Affects Non-Users
The privacy issue extends beyond the person who installs an AI agent. If a user connects an inbox or messaging service, the agent may process information about senders and people mentioned in conversations, even if those people have never used Muse. That does not mean every message is necessarily read or retained: access depends on connectors, permissions and the task, and Meta says email is not downloaded wholesale unless instructed.
Still, AI summaries and memory features can turn scattered conversations into organized profiles or reminders. The investigations’ account of regularly updated pages raises questions about how information about relationships, disputes and shared plans is represented. For non-users, the practical concern is that another person controls the agent and its connections. They may have no direct way to inspect or edit what it derives from messages they sent.
The business context also draws attention to the scale of the service, but funding should not be confused with evidence about data use. The source reports Meta sold $25 billion in stock at $625 a share, alongside $12.5 billion in preferred stock, and says Nvidia is investing $3 billion while Meta expands work on Muse. Those figures describe financing and a commercial partnership; they do not by themselves establish what information the agent accesses or how it is used.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
Muse’s Rollout and Connected Apps
Meta launched Muse in the United States on September 8, then expanded to Japan on October 23, described in the source as its first market outside North America. Singapore followed on October 27. Meta calls Muse a personal AI agent that can perform tasks such as handling email, booking tables and shopping. TIME reported that it had more than 5 million downloads within weeks; the source provides no independent confirmation or additional measurement details.
The access settings differ by service. Some connections require explicit permission, while accounts in the same Accounts Center may connect automatically. Meta’s policy also describes connector data that can be shared proactively, so the exact moment information is accessed may depend on the connector and task. A user can disconnect connectors, change model-training settings, edit a memory file or reset Muse. The source says model training is on by default, but the specific settings and available controls may vary by product or account.
Meta’s help material says that after a user deletes information, Muse may still remember information it learned from it “to the best of its ability.” The source also reports that TIME found instructions telling Muse not to point out that original messages may remain visible. This distinction matters: asking an agent to forget a detail is not necessarily the same as deleting the underlying email or message from its original service.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, speaking to WIRED
Questions About Profiles and Deletion
The source material does not establish precisely which messages are processed in every connector, how long derived information is retained, or whether users can see and remove every profile about other people. Meta’s public help pages reportedly give limited detail about the scope of Instagram direct-message and Messenger access. The investigations describe internal instructions, but the material here does not independently verify how consistently those instructions operate in practice.
It is also unclear what “forget” removes from Muse’s systems, what remains in original accounts, and how any de-identified lessons shared across the system are handled. Meta did not dispute TIME’s findings, but its quoted response did not address each reported practice separately. The reported download figure and financing details likewise do not establish how many people have enabled particular connectors or how often Muse accesses their data.
Check Connectors Before Using Muse
Muse users can review connected apps, disconnect services they do not want the agent to access, check model-training controls, inspect or edit its memory file, and reset the agent. People concerned about a particular message can also consider what they share with contacts who use AI assistants. The source says WhatsApp’s Advanced Chat Privacy may help limit what is retained in other people’s archives, though it does not give a full account of its protections or how it interacts with Muse.
Readers should look to Meta’s help pages and privacy policy for connector-specific changes as Muse expands. The next developments to watch are clearer explanations of what Messenger and Instagram connections can access, how derived memories are deleted, and whether people mentioned in a user’s communications receive any additional controls. Meta has not provided those details in the statements cited here.
Key Questions
Can Muse read every message in a user’s accounts?
Not necessarily. Access depends on the connector, permissions and task. Meta says email access permits searching but does not download the whole inbox unless instructed. Its published information does not fully specify the scope of every messaging connector.
Can someone who does not use Muse appear in its information?
Yes, according to the investigations cited in the source. They reported instructions to maintain pages about people mentioned in a user’s communications. Meta did not dispute TIME’s findings, but says each user controls their own Muse and its access.
Does asking Muse to forget something delete the original message?
No. Forgetting a detail in Muse is different from deleting an email or message in its original app. Meta’s help information says Muse may still remember information it learned even after deletion.
What can Muse users do to limit access?
Users can review and disconnect connectors, change model-training settings, edit Muse’s memory file or reset the agent. They should also check permissions for individual services, including macOS Full Disk Access for the Messages connector.
Source: ThorstenMeyerAI.com
