🔍 Read the full analysis: Meta’s AI Agent Could See Your Messages Even Without Muse on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reports by WIRED and TIME say Meta’s Muse instructions tell the agent to maintain and update information about people in its user’s life, including people who never signed up. Meta says each user controls Muse’s access, but nonusers have limited direct control over what other people’s agents can process or retain.
Meta’s Muse personal AI agent may process information about people who never signed up for the service when its users connect messages and other accounts, according to reports by WIRED and TIME. The reports say Muse’s instructions include creating and updating pages about people mentioned in users’ communications; Meta says each user controls what access the agent receives, while the extent of nonusers’ control and the limits on deletion remain unclear.
Muse is a cloud-based assistant that can carry out tasks such as searching email, answering messages, making bookings and shopping. Meta says the agent operates in a private virtual machine for each user. It launched in the United States on September 8, expanded to Japan on October 23 and was announced for Singapore on October 27, according to the source report. TIME reported more than 5 million downloads within weeks; the source does not provide the precise measurement period or a comparison baseline.
Muse accesses other services through connectors. Meta’s help information says email access lets Muse search messages but does not download an entire inbox unless the user directs it to. Calendar connectors can send updates proactively. The source says Facebook, Instagram and Threads may connect automatically when accounts share an Accounts Center. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and identified a Messenger connector, although the source says Meta’s help pages do not document the full scope of those connectors. Mac Messages access requires permissions and activation, while Meta says it does not review custom connectors.
WIRED reported on internal instructions obtained by security researcher Karan Joshi, and TIME later reviewed instructions separately. The reported guidance tells Muse to keep a page for each person in its user’s life and refresh information hourly, drawing on communications the agent can access. TIME’s account described details about relationships, shared interests and conflicts. Meta did not dispute TIME’s findings in the source material. The reports describe what the instructions direct Muse to do; they do not establish that every user’s agent has accessed every possible message or created a complete profile of every contact.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Privacy Beyond Muse Users
The issue extends the privacy question from what an AI assistant knows about its own user to what it may infer about that user’s contacts. A person who has never installed Muse could still appear in material their friend or relative gives the agent access to. That creates a meaningful difference between controlling one’s own account and controlling information contained in someone else’s account.
The practical reach depends on which connectors are enabled, what messages are available to Muse, and how the agent stores and uses information derived from them. For group chats, one participant’s use of an assistant could expose messages written by other participants to processing, even if those participants do not use Muse. The source does not establish that Muse independently opens a nonuser’s account or reads all conversations in a connected app; the concern described is access through the Muse user’s permissions.
The timing also matters for users weighing the service’s growing availability against its data practices. Meta is expanding Muse internationally and promoting it as an agent that can act across services. Greater utility can depend on granting access to more personal information, while the people represented in that information may have few direct settings to limit its use.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Apple MacBook Pro 16-inch Laptop with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 2TB SSD, Space Black
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How Muse Gets Its Access
Muse is described as an assistant running on a cloud computer, rather than simply a chatbot confined to one conversation. Meta says users can interact with it through its app, on a Mac or through a Muse chat in WhatsApp. The source distinguishes that WhatsApp chat from access to a person’s other WhatsApp conversations: opening Muse in WhatsApp does not, by itself, mean the agent reads those other chats.
Meta’s connector model is central to the reports. Users can authorize services such as email or Mac Messages, while some Meta accounts may connect automatically through a shared Accounts Center. The source also notes that the privacy policy refers to connector data shared proactively and to information about users or other people. These policy descriptions and connector listings show possible routes for information to reach Muse, but they do not prove that the agent uses every connector continuously or reads every available message.
The source says users can disconnect connectors, switch off model training, edit a memory file or reset Muse. It also reports that people who are not Muse users have fewer direct controls, though some messaging services offer settings that can restrict how chats are handled by other participants’ devices. Those controls vary by app and should not be treated as a universal way to remove information already seen or stored elsewhere.
“They’re trying to know you like a friend, which is honestly pretty creepy.”
— Karan Joshi, security researcher, quoted by WIRED
Limits of Access and Deletion
The source material does not establish how often Muse creates or refreshes profiles about nonusers in practice, how many users have enabled relevant connectors, or which specific messages are retained. The reported internal instructions describe intended behavior, not a complete audit of actual processing across the user base. Meta’s statement about user control also does not explain what direct remedies, if any, are available to people whose information appears in another person’s agent.
Deletion is another unresolved point. Meta’s help information says Muse may still remember information learned from something a user deletes and that it forgets information “to the best of its ability,” according to the source. That wording leaves open what remains in logs, backups, derived summaries or other records, and how long any such information persists. The source also reports that TIME found instructions not to highlight the possibility that original messages may remain visible; Meta’s response to that specific finding is not given.
The source’s financial details connect the story to Meta’s wider investment in Muse, but they do not show that financing terms determine the agent’s privacy practices. It reports a $25 billion stock sale at $625 a share, $12.5 billion in preferred stock, and a $3 billion Nvidia investment. The precise structure and implications of those transactions are not independently established in the supplied material.
What Users and Meta Should Clarify
For users, the immediate step is to check which connectors Muse can access and review the permissions and memory controls in each connected service. Disconnecting an account may limit future access, but the source does not establish that it erases information Muse has already processed. People who do not use Muse can ask contacts to avoid sharing sensitive conversations with an agent and review any privacy controls offered by their messaging apps, while recognizing that these steps cannot guarantee removal of material already copied or summarized.
The next questions for Meta are how nonuser information is stored, whether hourly profile updates occur across accounts or only in particular circumstances, how long derived memories remain, and what process exists for a person who wants information about them removed. Further reporting or company documentation may clarify whether the reported instructions reflect current product behavior and how connectors handle group conversations.
Muse’s rollout is continuing after launches in the United States and Japan and the announced Singapore expansion. As availability grows, clearer explanations of connector scope, retention, model training and nonuser protections will help users understand what they authorize—and what their contacts may share indirectly.
Key Questions
Can Muse process messages from people who never signed up?
It may process messages about or from nonusers when a Muse user gives the agent access to a service containing those messages. WIRED and TIME reported instructions for maintaining information about people in a user’s life. The reports do not establish that Muse reads every message or accesses nonusers’ accounts directly.
Does opening Muse in WhatsApp let it read all WhatsApp chats?
Not according to the source report. It describes Muse in WhatsApp as a chat the user opens, not as automatic access to that user’s other WhatsApp conversations.
What controls can a Muse user use?
The source says users can disconnect connectors, turn off model training, edit Muse’s memory file or reset the agent. The exact effect of each control, especially on information already processed, is not fully detailed in the supplied material.
Does deleting a message remove what Muse learned from it?
That is not clear. Meta’s help information, as quoted in the source, says Muse may still remember information learned from deleted material and describes forgetting as occurring “to the best of its ability.”
Has Meta confirmed that every Muse user has profiles about their contacts?
No such universal claim is established by the source. WIRED and TIME reported on Muse’s instructions, and Meta did not dispute TIME’s findings, but the material does not show how often the described behavior occurs across users.
Source: ThorstenMeyerAI.com
