Meta’s new personal assistant, Muse, has attracted millions of downloads, with users linking bank accounts, messaging apps and health trackers. The service promises to handle tasks ranging from scheduling to purchases, while gathering a wide range of personal signals. In parallel, a group of independent researchers has pulled internal files from the app, offering a rare look at its underlying logic and data handling practices.
AI safety researcher Karan Joshi managed to retrieve a large set of Muse’s operating instructions by prompting the chat interface to copy its own software files. He then supplied the extracted material to WIRED for analysis, demonstrating that the assistant’s codebase can be accessed through ordinary user interactions without special privileges. The dump includes system prompts that guide Muse’s responses to sensitive or political queries.
Among the disclosed directives is a routine that generates a dedicated page for each individual in a user’s network. The process runs hourly, aggregating information about family, friends, colleagues and other contacts. Pages begin sparsely and may grow to contain sections such as Facts, History, The relationship, In common, Open threads and Strengthening. The documentation stresses that only verified evidence should be used, and that fabricating details is considered worse than leaving a field blank.
Muse runs on a separate virtual machine allocated to each account, isolating user data from other agents. The VM can be reset or have external connections revoked at any moment, and an audit log records every action and planned future step. Before performing irreversible operations like sending email or completing a purchase, the assistant seeks explicit human approval, providing an additional safeguard against unintended behavior.
Miranda Bogen, director of the Center for Democracy and Technology’s AI Governance Lab, notes that Muse places a stronger focus on personal contacts than many competing assistants. She observes that the tools “plug their whole lives in,” urging users to connect emails, calendars and financial services. Bogen warns that this expansive data collection could dramatically increase the amount of personal information held by a single AI system.
Meta maintains that the exposed files were deliberately made accessible to promote transparency, and they illustrate how Muse handles prompts on politicized or sensitive topics. The company emphasizes that the assistant’s memory feature is intended to enhance personalization while preserving user control through editing capabilities and clear visibility of activity. The recent leak highlights the growing tension between convenience, data depth and the need for robust oversight in AI-driven personal assistants.