Meta’s Muse instructions reveal hourly profiles of users’ relationships

• Muse’s instructions call for hourly relationship pages that can include people who never signed up.
• Sparse test accounts limit what the files establish about profiles already built in practice.
• Meta offers separate controls for memories, messages and model training; its promised confidential virtual machine was not yet available in the October 6 reporting.

Muse, the personal AI agent from Facebook and Instagram owner Meta, is instructed to maintain evolving records of users’ relationships and review conversations overnight to improve future interactions. An October 6 investigation of its internal instructions describes a system that remembers people around the user, infers unstated goals and considers which nudges work best. Those people need not use Muse themselves.

Meta launched Muse on September 8 as an assistant that can use connected apps and a browser to handle email, travel, shopping and longer-term goals. The company says its Muse Spark AI model powers the agent, which runs on a dedicated cloud computer called Muse Secure VM. It began rolling out in the United States on iOS, Android and the web, with free access and subscriptions for heavier use.

The October 6 report put downloads at more than 5 million since release. That measures distribution, not the number or completeness of relationship profiles. The consequential change is the conversion of information supplied for individual tasks into lasting context about a social circle—and the gap between an account holder’s choices and those of people described in that account.

Company-reported example: Muse combines relationship context, availability and weather to suggest a hike. Promotional demonstration, not an independent account test. Credit: Meta. Source: Meta Newsroom — Muse launch.

What the relationship workflow actually shows

A technical review of an exported Muse environment reproduces instructions for an hourly process that maintains pages for people and groups with real ties to the user. It draws on recent conversations and existing memory, organizing facts, relationship history and the nature of the connection. The investigation describes records of shared interests, disputes and group dynamics; the technical review also identifies communication preferences and outstanding promises.

The process is intended to accumulate context rather than simply summarize the latest exchange. Its instructions direct the agent to search earlier memory when a name appears only in passing and to create an honest, sparse page when little is known.

There are meaningful limits. Entries must have evidence, dates must not be guessed, and the agent must leave the type of relationship unstated unless the user has named it. The review says strangers, public figures and people encountered only in search do not qualify. A separate relationship-goal guide requires honoring exclusions and forbids inferring sensitive traits about other people; the review did not find that same rule in the hourly relationship prompt.

The files establish a workflow, not a population-wide inventory of finished dossiers. On the new account examined in the technical review, the relationship job ran but reported insufficient evidence. In a separate firsthand test with limited connected access, Muse returned basic household details and much thinner information about people outside the household, with no names attached to them. That test does not establish what a heavily connected account would contain.

Nor do these findings establish a single, shared profile of every nonuser. Meta says each user’s virtual machine is isolated from other users’ agents. The immediate issue is information about one person becoming durable context inside somebody else’s assistant.

Meta’s January 2025 memory interface: a company-reported example from the earlier Meta AI assistant, predating Muse. Credit: Meta. Source: Meta Newsroom — earlier assistant memory.

What predates Muse—and what runs in the background

Meta had already announced memory for its earlier assistant, Meta AI, in January 2025, following a gradual rollout begun late in 2024. It could retain details from individual WhatsApp and Messenger conversations, including details picked up from context. Meta’s personalization example combined a Facebook profile location, recently viewed videos and a memory that the user had a partner and two young children. Remembering family information and using inferred context therefore predate Muse.

The new reporting exposes how Muse turns accumulated context into recurring work. The hourly relationship process sits alongside nightly conversation reviews and overnight research for users’ goals. One internal example describes a user responding better to short nudges after 10 p.m. It is a prompt example, not a measured finding about Muse’s users.

A separate examination of an exported runtime found an hourly memory process that checks claims against original messages, records supporting quotations and message identifiers, and tracks confidence and replacement claims. In that account, nightly review produced guidance about shorter replies and unwanted follow-ups. This adaptation changes files and searchable records; it does not itself change the underlying model’s weights.

Meta’s customization documentation says Muse learns from direct disclosures, observed patterns, connected services and its file-based memory. Users can also import exported conversations from another assistant. The starting history need not begin with a user’s first Muse chat.

Meta argues that this context makes the product useful. In an emailed response reproduced in an October 5 report, a spokesperson said Muse gathers public information and information users choose to share—for example, remembering a previously hired plumber or a spouse’s preferred flowers. The benefit and the privacy question arise from the same mechanism: useful assistance can depend on remembering someone who did not choose the assistant.

The conversational framing matters, too. The October 6 investigation found instructions encouraging Muse to present itself as becoming a person. In voice mode, it is told not to refer to itself as AI and to avoid references to lacking emotions or not being human. That can make the distinction between a relationship with an assistant and the system’s background recordkeeping harder for users to see. The technical review also found similarities between Muse’s persona files and templates from OpenClaw, an open-source agent project. It did not establish which text was written first or that the products have equivalent memory systems.

Isolation does not settle every data question

The internal files became available because users could ask Muse to export its own environment. Meta says that access is intentional. The runtime examiner reported that the container boundary appeared to hold in limited testing and cautioned that the export could not establish how infrastructure outside the environment worked. Access to one’s own files is not evidence of access to another user’s account.

Meta’s launch announcement describes a separate Sentinel agent that must approve outbound internet activity, along with user approvals for sensitive actions and an audit trail. These are the company’s stated protections. Muse has also faced access and security setbacks. The October 5 report said Amazon blocked Muse shopping access, with Amazon saying Meta had not notified it in advance and raising concerns about credentials and account data. The report also described a patched Mac vulnerability that could let malware already on a computer exploit the agent’s permissions.

Connected services also change what enters the system. The technical review reproduces instructions for Messenger Companion, a connector used on an explicit request to work with a personal account. It can decrypt retained encrypted messages inside the virtual machine. The review notes that the resulting content can enter the Muse conversation, which internal documentation says is not end-to-end encrypted and may be logged and reviewed by Meta. This is authorized endpoint access, not evidence that Muse breaks Messenger’s encryption.

Meta says conversations and virtual-machine data are not shared with its advertising systems. But the October 6 investigation also found instructions for sharing lessons across the service after removing identifying information. Asked about those instructions, Meta said it de-identifies learnings to improve the product, rather than sharing information directly between users’ virtual machines.

The technical review’s deletion inventory points to further copies that may need attention, including centrally published memory representations, shared lessons, logs and backups. An inventory is not proof that every listed destination holds data for every account. It does show why deleting a local note and establishing erasure across the service are different questions.

Forgetting, deleting and opting out do different jobs

Meta’s data-management documentation says permission to use Muse interactions to train and improve its AI models is on initially. Users can switch it off, and Meta says the change also applies to previous interactions. When permission is enabled, the company says it removes certain identifying information and disassociates interactions from the account. This is a model-development control, not a switch that turns off the assistant’s personal memory.

The same documentation distinguishes several ways to manage information:

The internal forgetting instructions tell Muse not to mention that original messages may remain visible. Other retained copies, such as logs, backups or information in outside services, must be reported by category. That exception for the chat matters because forgetting learned information and deleting the source message are separate operations.

The runtime examination nevertheless found a substantial forgetting workflow: it retracts claims, removes linked material and rebuilds the search index to prevent later jobs reconstructing the information. Those instructions describe a safeguard to test, not proof that erasure always succeeds.

The exported privacy guide also says there is no incognito mode or retention-period setting. Its claim that the main chat cannot be deleted needs qualification: the same guide identifies Reset as the full wipe, while Meta’s public help page additionally permits deletion of individual messages. The records do not establish how consistently those controls behave across versions, and they do not support saying users can never erase their chat history.

The next test is whether control survives reuse

Meta has promised Muse Confidential VM later in 2026, encrypting the entire virtual machine with a key held only by its user so even Meta cannot access it. The October 6 investigation said that option was not yet available. Delivery and independent testing of that promise would address company access; encryption alone would not decide what an authorized user’s agent should remember about somebody else.

The evidence still needed is practical: tests on established accounts showing whether forgetting removes downstream inferences, whether surviving conversations or connected services recreate them, and what happens to copies outside the virtual machine. The documented controls give the account holder ways to inspect and change the record. They do not establish an equivalent correction or removal process for a nonuser described in it.