🔍 Read the full analysis: A Guide To Limiting What Meta’s AI Agent Sees In Your Messages on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse personal AI agent can use connected services, including Meta apps, to access information available to its user. Reporting by WIRED and TIME says Muse’s instructions direct it to maintain and update profiles of people mentioned in messages; Meta did not dispute the findings and says users control access. Users can disconnect connectors or reset Muse, while people who never signed up have fewer ways to limit what other users’ agents can process.
Meta’s Muse AI agent can search or use information from services its user connects, including email and Meta apps, while reporting by WIRED and TIME says its instructions tell it to keep updated profiles of people mentioned in messages. A guide published October 28 outlines the available privacy settings and the limits facing people who never signed up for Muse but appear in someone else’s conversations.
Muse gets access through connectors, links between the agent and other services. Meta’s help information says connecting email lets Muse search messages, though it does not download the entire inbox unless the user asks. Calendar information can be sent to Muse proactively. Meta also says Facebook, Instagram and Threads accounts can connect automatically when they share an Accounts Center with Muse. Users can enable a Mac Messages connector after granting macOS Full Disk Access. Meta warns that it does not review custom connectors.
Meta chief AI officer Alexandr Wang said in a post on X that the Instagram connector includes direct messages and that Muse has a Messenger connector. Meta’s public help pages do not spell out the full scope of those connectors. Muse in WhatsApp is a chat users open, according to the source material; that is distinct from access to their other WhatsApp conversations.
WIRED reported on October 3 that Muse’s instructions direct it to create “a page for every person in the user’s life.” TIME later reviewed the instructions and reported that the agent updates files hourly, including information about people named in chats, messages and emails. Meta did not dispute TIME’s findings. A spokesperson said: “Each person stays in control of their Muse and decides how much access it gets.” The controls belong to the Muse user, not necessarily to other people whose information appears in connected material.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Controls Belong to the User
The issue reaches beyond people who install or use Muse: messages are written by more than one person, but the account holder who connects them is the one who decides what the agent can access. If a person’s messages or details appear in another user’s connected email or social accounts, the person may have no direct settings in Muse to control the agent’s access.
For Muse users, connector and memory settings can reduce what the agent sees or retains, but they do not necessarily erase information already learned from messages. Meta’s help material says Muse forgets information “to the best of its ability” and may still remember information it learned from deleted material. That distinction matters: removing a source or asking Muse to forget is not the same as confirming that every trace has been deleted.
The source also describes a commercial backdrop: Meta sold $25 billion in stock at $625 a share, along with $12.5 billion in preferred stock, and Nvidia said it would invest $3 billion. The companies are expanding their work on Muse, and Meta is deploying Nvidia chips for the agent. Those figures establish the scale of the business development, but do not by themselves show how the investment will affect data practices.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
Muse’s Connectors and Rollout
Meta launched Muse in the United States on September 8, describing it as a personal AI agent that can carry out tasks such as answering email, booking tables and shopping. Japan followed on October 23, and Meta announced Singapore on October 27. TIME reported that Muse had more than five million downloads within weeks; the source material does not provide a separate measurement method or comparison baseline for that figure.
Meta says each user gets a Muse Secure VM, a private virtual computer that other users’ agents cannot access. Users can interact with Muse in its app, on a Mac or through a chat in WhatsApp. These descriptions concern the agent’s computing environment and ways to access it; they do not establish that information in connected services is never processed or retained.
Reporting on Muse’s instructions has focused on the agent’s memory of people around its user. WIRED’s October 3 report was based on files obtained by security researcher Karan Joshi, who said he elicited them by asking Muse in chat. TIME reviewed the instructions separately three days later. The two outlets’ findings are reporting about the agent’s internal directions, while Meta’s own help pages describe connectors and controls.
“Muse has connectors “like Instagram (incl dm’s), Threads, Facebook (incl marketplace), and Messenger.””
— Alexandr Wang, Meta chief AI officer, in a post on X
The Limits of Deletion and Access
The exact scope of every connector is not fully documented in Meta’s public help material. In particular, it does not spell out what information the Instagram direct-message and Messenger connectors can access. The source material also does not establish exactly when each connector supplies data, how long each category is retained, or how fully a deletion or “forget” request removes information derived from messages.
Meta did not dispute TIME’s account of Muse’s instructions, but the source does not include a detailed response from the company addressing each reported behavior or describing independent verification. It is also unclear what remedies, if any, people who do not use Muse can request when their information appears in another user’s connected accounts. Details about how the announced investment relates to specific privacy safeguards were not provided.
Review Connectors and Memory Settings
Muse users can review connected services, disconnect connectors they do not want the agent to use, and turn off model training, which the source says is on by default. They can also edit Muse’s memory file or reset the agent. Those steps can limit future access or change stored memory, but Meta’s wording does not promise complete removal of information already learned.
People who do not use Muse have fewer direct options. The source points to WhatsApp’s Advanced Chat Privacy as one way to limit what is available in other people’s archives, though it does not prevent someone from sharing or accessing information elsewhere. Further clarity will depend on Meta publishing more detail about connector scope, retention, and deletion, and on how the company responds to continued scrutiny of Muse’s reported memory instructions.
Key Questions
Can Muse read every message in a connected email account?
Meta’s help information says connecting email lets Muse search messages, but it will not download the whole inbox unless the user tells it to. The source material does not specify the full scope or retention rules for every connector.
Are Instagram DMs included?
Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages. Meta’s public help pages, as described in the source, do not provide a full account of what the connector can access.
Can someone who does not use Muse stop another person’s agent from processing their messages?
The source describes few direct controls for non-users. They may be able to limit what is retained in some shared spaces, such as with WhatsApp’s Advanced Chat Privacy, but it does not establish a general way to control information in another person’s connected accounts.
Does asking Muse to forget something delete it completely?
Not necessarily. Meta’s help information says Muse forgets information “to the best of its ability” and may still remember information learned from deleted material. The source does not describe a guarantee of complete deletion.
What can Muse users do to limit access?
Users can disconnect connectors, turn off model training, edit the memory file or reset Muse. These actions change access or memory settings, but the available information does not confirm that they erase every detail the agent may have learned already.
Source: ThorstenMeyerAI.com
