Extracted instructions from Meta’s Muse personal AI agent describe an hourly process for maintaining structured pages about people in a user’s life, giving the assistant a richer memory of relationships while raising privacy questions that extend beyond the person who chose to install it.
Independent AI safety and security researcher Karan Joshi obtained Muse’s internal instructions and system files through the ordinary chat interface and shared them with WIRED. One of the instructions says Muse can keep “a page for every person in the user’s life,” with the process covering family members, partners, friends, colleagues, collaborators and people a user follows.
The pages are part of Muse’s persistent memory system. According to the extracted materials, they can accumulate facts, shared history, relationship context, dates that matter and unfinished topics over time. The goal is to give the agent enough context to make more personalized suggestions — remembering, for example, what a friend likes or what a user previously discussed with a colleague.
That design is not unusual in principle for a personal AI assistant. The more context an agent retains, the more useful it can become across long-running tasks and conversations. What makes the Muse implementation notable is how explicitly the instructions appear to formalize information about other people into recurring, person-specific memory pages.
The files should not be read as proof that every Muse account contains a complete or accurate profile of every person mentioned by a user. They describe intended system behavior and page structures, not a measurement of how consistently Muse follows the instructions in every account or how often the information it records is correct. A sparse or inaccurate memory page is still possible.
Meta told WIRED that the operating files were intended to be accessible to users as part of the company’s transparency approach. In Meta’s official Muse announcement, the company says each user’s Muse runs in a dedicated virtual machine, isolated from other users and agents. Meta says users can wipe memories, disconnect external services and review an activity log showing what the agent has done and what it plans to do.
Those controls address part of the privacy problem, but they do not fully resolve it. A user can choose whether to connect an email account, a calendar or another service, and can delete their own agent memory. The people represented inside that memory — a friend, spouse, coworker or contractor — may never have made any equivalent choice about having relationship information organized by someone else’s AI assistant.
That makes persistent AI memory different from a conventional address book. An address book stores information the user enters. A reasoning system can also infer relationships, combine data from multiple sources and use those inferences to shape future suggestions. The more capable the assistant becomes, the more important it is to distinguish what the user explicitly supplied from what the system inferred.
The privacy risk is therefore not simply that Muse “knows” things about people. Human users already keep notes, messages and memories about others. The shift is that an automated system can structure those details continuously, connect them across services and act on them at scale. Errors can become persistent context, and sensitive facts can gain more operational significance once an agent starts making decisions or recommendations from them.
Meta’s architecture gives users meaningful controls over their own agent environment, but the extracted instructions expose a broader policy question that consumer AI products are only beginning to confront: what rights, if any, should people have when they appear inside someone else’s AI memory?
For now, the strongest evidence is narrower than the most dramatic interpretation. Muse’s instructions appear to be designed around persistent relationship pages, and Meta says that design supports personalization inside an isolated, user-controlled environment. What the reporting does not establish is that every profile is complete, correct or even present for every person. The privacy debate begins in the space between those two facts.
