🔍 Read the full analysis: How To Understand And Limit Meta’s AI Agent’s Message Access on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta expanded its Muse AI agent to Singapore on October 27, while reporting has raised questions about how it handles information about people who never signed up. Meta’s help pages describe ways users can limit access, but non-users have fewer direct controls over messages and details held in another person’s account.
Meta announced Muse’s expansion to Singapore on October 27, as separate reports questioned how the company’s AI agent handles information about people mentioned in a user’s messages. Meta says each user controls what the agent can access; people whose messages or personal details appear in those accounts have fewer direct controls.
Muse is a personal AI agent that runs in a cloud-based virtual computer and can take actions such as searching email or booking services. Meta launched it in the United States on September 8, according to the source report, and expanded it to Japan on October 23 before announcing Singapore. Meta describes each user’s environment as a private “Muse Secure VM.” In WhatsApp, the agent is a chat a user opens; the source says that does not make it a reader of the user’s other WhatsApp conversations.
The agent’s reach depends on its connectors, which link it to other services. Meta’s help pages say email access lets Muse search email, but does not download an entire inbox unless the user asks. Calendar connectors may send updates proactively. Meta says Facebook, Instagram and Threads connect automatically when they are in the same Accounts Center as Muse. Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages and that Messenger has a connector, though the source says Meta’s help pages do not fully document what those connectors can read.
Mac Messages access requires permission: Meta says a user must grant macOS Full Disk Access and enable the connector. Users can also create custom connectors, which Meta says it does not review. Meta’s privacy policy, as quoted in the source, describes information gathered through connectors and includes “information about you or others.” The exact data available can therefore depend on which services a user connects and what permissions are granted.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Why Other People’s Messages Matter
The issue extends beyond a Muse user’s own information. If an agent can search communications shared with that user, people who never installed Muse may still be represented in its records. Reports cited by the source say Muse’s internal instructions direct it to maintain a page about people in the user’s life and refresh information regularly. These accounts raise questions about how personal details, disputes and relationships may be summarized, retained or used.
That distinction matters for consent and practical control. A Muse user can choose which connectors to activate, but a person who sends them a message may not be able to prevent the recipient’s agent from processing it. This does not mean every message is continuously read or every detail is retained in the same way; the source material does not establish that scope. It does show why reviewing permissions and discussing sensitive communication with contacts can matter.
The source also reports a major financial arrangement alongside the expansion: Meta sold $25 billion in stock at $625 a share and issued $12.5 billion in preferred stock, while Nvidia invested $3 billion. It says Meta plans to deploy Nvidia chips for Muse. Those figures indicate the scale of the companies’ relationship, but do not by themselves establish how the investment will affect the agent’s data practices.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
As an affiliate, we earn on qualifying purchases.
How Muse’s Access Is Set Up
Meta presents Muse as an assistant that can act across services, rather than a chatbot limited to a single conversation. Its access comes through connectors and permissions. Some connections are user-enabled, such as Mac Messages, while Meta says Facebook, Instagram and Threads can connect automatically when accounts share an Accounts Center with Muse. The source says users can disconnect connectors, turn off model training, edit the agent’s memory file or reset Muse.
Concerns about records on non-users followed reporting on Muse’s instructions. WIRED reported October 3 on files that security researcher Karan Joshi obtained by asking Muse questions. TIME later reviewed the instructions separately. According to the source’s account of those reports, the files direct Muse to create a page for people in a user’s life and update information drawn from chats, messages and email. The source says Meta did not dispute TIME’s findings.
Deleting or asking Muse to forget information may not equal deletion from all records. Meta’s help information, as quoted by the source, says Muse may still remember information it learned after a user deletes something, and describes forgetting as working “to the best of its ability.” The supplied material does not include the complete help-page language or all retention details, so the precise effect of each control cannot be stated here.
What Meta Has Not Specified
The precise scope and timing of data processing remain unclear. The source says Meta’s policy describes connectors that may share information proactively, but it does not establish how often each connector accesses data, which messages are processed in a particular case, or how long information about non-users is retained. It also does not establish whether every Muse installation uses the reported profile instructions in the same way.
The source reports that Meta did not dispute TIME’s findings and gave a general statement about user control. It does not provide a detailed response from Meta addressing the reported person-by-person files, the hourly update instruction, or the use of de-identified lessons across the system. The meaning and effect of those reported practices, including any safeguards for people who do not use Muse, remain unresolved in the supplied material.
Review Connectors and Privacy Controls
Muse users can start by checking which connectors are enabled, disconnecting services they do not want the agent to access, and reviewing the model-training and memory settings described in Meta’s help pages. Mac users should check whether they have granted Full Disk Access. Anyone using custom connectors should account for Meta’s warning that it does not review them. A request to forget information should not be treated as proof that every copy or learned detail has been erased.
People who do not use Muse have fewer direct controls over information in someone else’s account. The source points to WhatsApp’s Advanced Chat Privacy as one way to limit what recipients can export or use in other services, but it does not say that this blocks all copying or processing. Meta’s further explanations of retention, connector behavior and controls for non-users will be important as Muse expands. The source provides no date for additional policy details or a next product milestone.
Key Questions
Can Muse read every message on a user’s phone?
Not according to the available details. Access depends on connectors and permissions. Meta says Mac Messages requires Full Disk Access and an enabled connector. The source says Instagram DMs and Messenger are among the connections identified by Meta’s chief AI officer, but their full scope is not documented in the help pages cited.
Can someone who does not use Muse stop it from processing their messages?
The source describes limited direct controls for non-users. A person can reduce some sharing through app privacy features, such as WhatsApp’s Advanced Chat Privacy, but the material does not establish that this prevents all processing when another person has access to a message.
Does telling Muse to forget something delete it?
Not necessarily. The source quotes Meta’s help information as saying Muse may still remember information it learned after the original item is deleted. It does not provide enough detail to say exactly what is removed, retained or recoverable in each case.
What settings can a Muse user change?
The source says users can disconnect connectors, turn off model training, edit the memory file or reset Muse. Users should also review permissions granted to connected services and check whether any custom connectors are active.
Source: ThorstenMeyerAI.com
