Muse's own prompts show Meta's agent building a page on every person in a user's life

A Muse user asks where to take a coffee-loving friend for breakfast, and the agent makes a suggestion ^[6]. The suggestion comes from a page. According to the instructions researcher Karan Joshi extracted, Muse keeps "a page for every person in the user's life" ^[1]. An hourly process fills those pages in for family, partners, friends, colleagues, "collaborators" and people the user follows ^[1]. An hourly job runs 24 times a day ^[14].

The friend's page can record where they live, what they do, "dates that matter" and history such as "the argument that got resolved" ^[8]. Its Strengthening section proposes "A reason to call, a date worth remembering, something they said to circle back on, a way to be there for them that matters" ^[13].

What users do with Muse is connect it to bank accounts, messages or health data and hand it tasks ^[2]. What Meta can point to is a set of protections. Each user gets a dedicated virtual machine that other agents cannot reach. Users can wipe memories, disconnect services, confirm before an email or a purchase goes out, and read an audit log of activity and future plans ^[10]. Each of those user-facing controls is operated by the account holder, and the reporting describes none for the friend in the breakfast question ^[15].

Joshi was blunt about the design. "They're trying to know you like a friend, which is honestly pretty creepy," he said ^[9]. Meta spokesperson Daniel Roberts gave the company's case: "For any agent to be useful and actually help you achieve your goals, it needs to have context about you and those you interact with" ^[11].

Joshi got the files through the regular chat interface, by essentially asking Muse to copy and share its own software files, according to WIRED ^[5]. Multiple researchers have dumped the agent's operating instructions in recent days ^[3]. Meta has maintained that it intended the files to be accessible, in the interest of transparency ^[4]. If that is true, the chat window did what Meta built it to do. The reporting establishes that anyone who asks can read how Muse is built. It does not show any user's bank, message or health data leaving the app by the same route.

The instructions do contain one sound rule. Muse should use only the "evidence" it has, and invented details are worse than an empty page ^[7]. That protects the user from bad advice about a real person. Carissa Véliz, an associate professor at Oxford's Institute for Ethics in AI, pointed at the direction the information flows. "We are giving AI systems much more information about us than we are getting information from them," she said ^[12].

For a team shipping an agent, I'd take two things from Muse. Assume the system prompt is public, since Muse handed its over in ordinary chat ^[5]. Then sort every record the prompt tells the agent to build by two questions: is it about the user or about someone else, and can that person see and delete it? Records about the user that the user can wipe sit in the box Meta's controls already cover ^[10]. Records about someone else that only the user can wipe sit in the hard box, and Muse's relationship pages are there ^[15]. The prompt line that builds them, "a page for every person in the user's life," is already public ^[1].