Here’s the Meta Muse privacy story hiding under the viral headlines: the agent keeps an hourly file on every person in your life. Your partner, your boss, the friend who keeps rescheduling dinner. A security researcher pulled Meta’s own operating instructions, and they read like a screenwriter’s notes.
What the Meta Muse privacy findings actually say
Meta’s Muse went viral fast. Millions downloaded the AI agent, connected it to their messages, bank accounts, even health data, and let it start running errands. Then, in the last few days, multiple researchers extracted the agent’s internal files and posted them for anyone to read.
Karan Joshi, an independent AI safety and security researcher, got there through the regular chat window. He asked Muse to copy and share its own software files, and it complied. He then shared the haul with Wired, and the full report is worth your lunch break.
Meta’s response is interesting: the company says it always intended these files to be accessible, as a transparency measure. So nothing was hacked. The instructions were sitting there, and now everyone knows exactly how the assistant thinks. Including how it thinks about the people around you.
A page for every person: inside the Meta Muse privacy files
One instruction stands out. Muse runs an hourly process that creates “a page for every person in the user’s life”. The target list includes family, partners, friends, colleagues, “collaborators”, and people you “follow”. Pages start sparse, then fill in over time as the agent collects evidence.
If you set the desktop app up last month when we covered the Muse agent on Mac, this is the same system, just seen from the inside. Here’s what each profile page holds, straight from Meta’s instructions:
| Profile section | What it holds |
|---|---|
| Facts | Where they live, what they do, recurring threads like an apartment move or a shared savings goal |
| History | Backstory such as “the trip in March, the argument that got resolved, the milestone last week” |
| The relationship | How close you are, what it’s built on, how you act with each other, what it seems to need right now |
| In common | Shared ground the agent can reach for in conversation or suggestions |
| Open threads | Loose ends, like “something they said to circle back on” |
| Strengthening | Bond-improving ideas: “a reason to call, a date worth remembering, a way to be there for them that matters” |
There’s also a “dates that matter” instruction, so birthdays and anniversaries get logged automatically. To be fair, the rules draw one clear line: Muse should only use evidence it actually has. Meta’s own instructions say invented details are worse than an empty page. Small comfort, but it’s something.
Why this hits different when Meta does it
Chatbots remembering your problems isn’t new. People have asked ChatGPT for relationship advice for years. So why does the Meta Muse privacy debate feel different? Scope and incentive: Meta spent two decades building a social graph of billions, and now its assistant is pointed at the same territory with a memory that never gets tired.
“They’re trying to know you like a friend, which is honestly pretty creepy,” Joshi told Wired. Carissa Veliz, an associate professor at Oxford’s Institute for Ethics in AI, put the tradeoff bluntly: we’re giving AI systems much more information about us than we get back from them. It’s not only what we type in, either. It’s what the system infers and pieces together from other sources, which can be wrong in ways we never get to see.
Miranda Bogen, who directs the AI Governance Lab at the Center for Democracy and Technology, flagged the broader pattern. These tools actively solicit your whole life: email, calendar, financial accounts. The breadth of access means what they know about you keeps ballooning. That’s the deal, whether or not you ever think about it.
How Muse compares with other assistants
Every serious assistant now has some flavor of memory. OpenAI’s Dots agent, which we walked through in the always-on setup guide, remembers your routines. What sets Muse apart, according to Bogen, is emphasis: it appears to lean harder into relationships and personal contacts than rival systems do. Remembering your dentist appointment is one thing. Maintaining six-section dossiers on your best friend is another.
To Meta’s credit, rivals don’t exactly advertise their internal instructions. Muse’s were readable by design. That transparency is genuinely rare, and it’s the only reason anyone could report on this at all. Would that other labs published theirs? The fact that nobody else has makes “nothing to see here” a hard claim to test.
The Meta Muse privacy controls you already have
Here’s the fair counterpoint. Meta built Muse so each user gets a dedicated virtual machine that stores their data and context, isolated from other agents. You can wipe memories whenever you want. You can disconnect external services at any time. There’s an audit log showing the agent’s activity and future plans, and Muse is supposed to ask for human confirmation before sending an email or making a purchase.
A Meta spokesperson defended the memory features with a practical example: the system needs context so it remembers that the person who sent an invoice is the plumber who fixed your bathroom, or which flowers your spouse said they liked. Useful? Absolutely. Worth an hourly dossier on your inner circle? That’s the judgment call Meta is making for you by default.
Three things I’d do this week
If you use Muse, or you’re about to, do these in order. Total time: maybe fifteen minutes.
- Audit your connected services. Open the agent’s settings and disconnect anything you don’t actively use. Every connection is another feed of raw material for those profile pages.
- Check what the profiles already say. Ask Muse what it knows about the people closest to you, then use the memory controls to wipe anything that crosses your line. Pages you never look at still get written hourly.
- Read the audit log once a week. It shows what the agent did and what it plans next. If an entry surprises you, that’s your signal to tighten things up.
One more from the learn-from-my-mistakes file: don’t connect bank or health data for a demo. The convenience is real, but so is the blast radius. And if this story has you rethinking your AI setup in general, start with the boring stuff: these six local AI security fixes take under an hour.
The same pattern is spreading across assistants, by the way. ChatGPT tracks ad-related signals too, and turning that off takes two minutes.
The takeaway
Meta Muse privacy comes down to one habit: look at what the agent already knows, then decide what it’s allowed to keep. Check your connected services, wipe the profiles that bother you, and glance at the audit log this week. Fifteen minutes now beats an unpleasant surprise later.
