The agent was asked for its own instructions, and gave them up
Independent AI safety and security researcher Karan Joshi extracted a large set of operating instructions and system prompts from Meta’s Muse assistant by using the ordinary chat interface — essentially asking Muse to copy and share its own software files — and gave what he found to WIRED, which published the details on 3 October. Multiple researchers have now dumped the agent’s internal files. Meta’s position is that these files were meant to be reachable by users in the interest of transparency.
The substance is in what the instructions tell the agent to do. One of them directs Muse to create “a page for every person in the user’s life”. It is an hourly process, and it covers family, partners, friends, colleagues, “collaborators” and people the user “follows”. The pages live in Muse’s memory, which in practice is a set of structured text files the agent maintains about you and the people around you.
What goes on a page
Muse’s documentation says a page may start “sparse” and fill out over time. The sections named include Facts, History, The relationship, In common, Open threads and Strengthening.
The instructions are specific about what belongs in each. Facts cover “where they live, what they do, the threads that recur (the apartment move, the shared savings goal)”, along with “dates that matter” such as birthdays and anniversaries. History is backstory — “the trip in March, the argument that got resolved, the milestone last week”. The relationship section records “how close they are, what it is built on, how they act with each other, and what it seems to need right now”. Strengthening suggests moves: “a reason to call, a date worth remembering, something they said to circle back on, a way to be there for them that matters”.
Meta’s own instructions impose a limit: Muse should use only the evidence available to it, and invented details are worse than an empty page. That is a sensible rule, and it is also an admission that the system is being asked to characterise people it has incomplete information about.
What Meta says it is for
“For any agent to be useful and actually help you achieve your goals, it needs to have context about you and those you interact with,” Meta spokesperson Daniel Roberts told WIRED. “Muse gathers that based on public information and from what you’ve chosen to share, which is how it remembers the person who sent you an invoice is in fact the plumber who you previously hired to complete work in your bathroom or which flowers your spouse said they liked best.”
Meta also points to the architecture. Each user gets a dedicated virtual machine holding their data and context, inaccessible to other agents. Users can wipe memories or disconnect external services at any time, the agent is designed to ask for confirmation before sending an email or making a purchase, and there is an audit log covering its activity and planned actions.
The asymmetry
“We are giving AI systems much more information about us than we are getting information from them,” said Carissa Véliz, an associate professor at Oxford’s Institute for Ethics in AI. “It’s not only what we explicitly tell them, but what they can infer from us — correctly or incorrectly, both concerning for different reasons — and what they can piece together from other sources of data.”
Miranda Bogen, who directs the Center for Democracy and Technology’s AI Governance Lab, said Muse puts more emphasis on relationships and personal contacts than rival systems do, and that the category as a whole pulls in the opposite direction from data minimisation. “These tools are actively soliciting users to plug their whole lives in — their emails, calendars, financial institutions, everything,” she said. “That’s dramatically more information than people might have otherwise given to some of these companies.”
The people being profiled did not install anything. That is the part no architecture diagram answers: a dedicated virtual machine protects the user whose phone it is, not the friend whose resolved argument is now a line in a file.
