🔍 Read the full analysis: How To Check And Limit Meta’s AI Agent’s Access To Messages on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Meta’s Muse AI agent can use messages and other information available through connected apps, including Instagram DMs, according to Meta and reporting by WIRED and TIME. Muse users can disconnect connectors, turn off model training, edit memory or reset the agent, but people whose messages appear in someone else’s account have fewer controls.
Meta’s Muse AI agent can search messages and other data available through connected services, while reporting by WIRED and TIME says its internal instructions direct it to maintain profiles of people mentioned in a user’s communications. That means people who never signed up for Muse may still have details about them processed through someone else’s account; the controls are largely in the hands of the Muse user.
Muse gets access through connectors that link it to other services. Meta’s help materials say connecting an email account lets Muse search messages, but does not download the entire inbox unless the user instructs it to. Calendar connectors may send updates proactively. Meta says Facebook, Instagram and Threads accounts in the same Accounts Center connect automatically. Meta chief AI officer Alexandr Wang has also said the Instagram connector includes direct messages and that Messenger has a connector, although Meta’s help pages do not fully document what those connectors can read.
Access to Mac Messages requires the user to grant macOS Full Disk Access and enable the Messages connector, Meta says. Users can also create custom connectors. Meta warns that it does not review those connectors. In WhatsApp, Muse is a chat users open directly; the source material says this does not make Muse a reader of their other WhatsApp chats.
WIRED and TIME separately reported on Muse’s instructions for maintaining information about people in a user’s life. TIME said the agent updates files about the user and people named in messages, chats and emails, including details about relationships and disputes. Meta did not dispute TIME’s findings. A spokesperson said: “Each person stays in control of their Muse and decides how much access it gets.” That control belongs to the account holder, not necessarily to other people whose messages appear in connected accounts.
Infographic 01 · What Muse can read
Muse reads what its user can read. That includes you.
Connectors decide what the agent sees. The user switches them on. The people in that user’s chats and inbox are never asked.
Sources a Muse user can open to the agent
The agent reads what its user can read. Everyone who writes to that user is inside.
| Source | How it connects | Status |
|---|---|---|
| Email (Gmail, Outlook) | Opt-in connector. Searches when a task needs it; downloads the whole inbox only if told to. | Meta document |
| Calendar | Opt-in connector. Can push changes to Muse on its own (“proactive”). | Meta document |
| Facebook, Instagram, Threads | Connected automatically if the accounts share an Accounts Center with Muse. | Meta document |
| Instagram DMs, Messenger | Named as Muse-only connectors (“Instagram (incl dm’s) … and Messenger”). What they read is not documented. | executive post |
| Mac Messages (iMessage) | Only with macOS Full Disk Access plus the Messages connector, Meta says. One columnist says it synced anyway. | disputed case |
| A place to chat with Muse, not a connector. Test-build text mentions Muse access to end-to-end encrypted chats. | leaked code | |
| Custom connectors | Muse can build links to other services. Meta does not review them. | Meta document |
What the instructions say
Extracted by researchers; reported by WIRED and TIME reported
- “A page for every person in the user’s life”: family, partners, friends, colleagues, people followed
- Notes on how people met, shared interests, disputes, “tensions and alliances”
- People who never signed up are mapped by other users’ agents
- De-identified “lessons” shared across agents; Meta did not dispute TIME’s findings
What Meta says
Privacy policy, help pages, spokespeople Meta document
- Each user’s VM is isolated; no other user’s agent can reach it
- Conversations and VM data are not shared with Meta’s ad systems
- “Each person stays in control of their Muse and decides how much access it gets”
- Forgetting works “to the best of its ability”; deleted data may still be remembered
Sources: Meta Help Center: Connectors; Muse Privacy Policy; Alexandr Wang on X (8 Sep 2026); TIME (6 Oct 2026); Tom’s Guide on WIRED’s report (6 Oct 2026); TechCrunch (30 Sep 2026); Digit (16 Oct 2026). Status labels: Meta document = stated by Meta; executive post = Meta executive on X, not in help pages; disputed = claim and denial on record; leaked = unreleased code, may never ship.
Powered by Thorsten Meyer AI
Why Message Access Reaches Beyond Users
The issue is not limited to what a Muse user types directly into the assistant. If a user connects an account, messages involving other people may become available for the agent to search or process. Those contacts may not know their communications are being used by an AI agent and cannot directly manage its settings.
This distinction matters in group chats, family conversations and work correspondence, where one participant’s decision to connect an account could expose messages involving several people. The source material does not establish that every message is continuously read: Meta describes some access as task-based, while its privacy policy also refers to connectors that can share data proactively. The exact scope depends on the connector and settings.
For Muse users, the practical point is to check which accounts are connected and what permissions they have granted. For people who do not use Muse, options are more limited: they may be able to reduce what is retained in other people’s archives, but they cannot operate another person’s Muse controls. This creates a privacy gap between account owners and everyone they message.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
How Muse Connectors and Memory Work
Meta describes Muse as a personal AI agent that runs on a computer in the cloud and can perform tasks such as answering email, booking tables and shopping. The company says each user receives a private “Muse Secure VM,” which other users’ agents cannot access. Muse launched in the United States on September 8, 2026, expanded to Japan on October 23 and was announced for Singapore on October 27.
Meta’s privacy policy says Muse may store “information about you or others.” Reporting by WIRED and TIME examined agent instructions that reportedly direct Muse to create and update pages about people in a user’s life. The source material says TIME reported hourly updates. Meta did not dispute those reported findings, but it has said that users decide how much access their agents receive.
Meta’s help pages also describe limitations in its memory controls. The company says Muse may remember information learned from material a user later deletes and may forget information “to the best of its ability.” That wording means forgetting is not the same as deleting the original message or guaranteeing that every detail derived from it is removed.
““They’re trying to know you like a friend, which is honestly pretty creepy.””
— Security researcher Karan Joshi, quoted by WIRED
What Meta Has Not Specified
The available materials do not give a complete, connector-by-connector account of which messages Muse can access, how often it reads them, or how long information derived from them is retained. Meta’s help pages describe email search and some connector behavior, but do not spell out the full scope of Instagram DM and Messenger access.
It is also unclear what happens to every detail in Muse’s memory after a user disconnects a service, deletes a message or asks the agent to forget something. Meta’s help language says forgetting works “to the best of its ability,” and the source material reports that TIME found instructions warning Muse not to emphasize that original messages may remain visible. The reported hourly updates and profile instructions come from news investigations; the source material does not include a complete public technical audit of the system.
The article’s source also describes a stock and investment deal involving Nvidia, but does not establish that the financing changes Muse’s privacy settings or data practices. That connection should not be treated as evidence of a specific change in how messages are handled.
Check Connectors and Review Memory
Muse users can start by reviewing connected services in the agent’s settings. They can disconnect connectors they do not want Muse to use, turn off model training, inspect or edit the memory file, and reset the agent. The source material says model training is on by default; users should check the current settings and help instructions in their own accounts, since menus and available controls may change.
People who do not use Muse cannot change another person’s connector settings. They can ask contacts not to connect accounts containing sensitive conversations and, where available, use app-level controls that limit what remains in other people’s archives. The source material gives WhatsApp’s Advanced Chat Privacy as one example of a measure that may reduce sharing or exporting from chats, not as a way to control Muse directly.
Further clarity depends on Meta publishing more detail about connector scope, retention and deletion, and on any updates to its help pages or privacy policy. Until then, users should treat connected accounts as information Muse may be able to access, and avoid assuming that deleting a message or issuing a “forget” request removes all related information.
Key Questions
Can Meta Muse access Instagram direct messages?
Meta chief AI officer Alexandr Wang said the Instagram connector includes direct messages. Meta’s help pages, as described in the source material, do not fully specify the connector’s scope or exactly when messages are accessed.
Can Muse read WhatsApp chats other than the Muse conversation?
The source material says Muse appears in WhatsApp as a chat that users open directly, rather than as a reader of their other WhatsApp chats. Users should check Meta’s current product and privacy documentation for any later changes.
How can a Muse user limit the agent’s access?
Users can disconnect connectors, turn off model training, edit the memory file or reset Muse. They should also review app permissions, including the macOS Full Disk Access permission required for the Messages connector.
Can someone who does not use Muse stop another person’s agent from processing their messages?
There is no direct control over another person’s Muse account described in the source material. Non-users can ask contacts not to connect accounts containing their messages and use available chat privacy settings to reduce what is kept or shared.
Does asking Muse to forget something delete the original message?
No. Meta’s help language says Muse may forget information “to the best of its ability,” and the source material says deleted messages may still be visible in their original accounts. A forget request should not be treated as a guarantee that the message or every detail learned from it is erased.
Source: ThorstenMeyerAI.com
