Muse Builds Detailed Profiles of Friends and Family

Muse detailed profiles turn your contacts into dossiers

Muse detailed profiles are the engine behind Meta's viral personal assistant. Newly surfaced instructions show just how far the system goes. It maps the people in your life. Millions have downloaded the AI agent, hooked it up to bank accounts, messages, and health data, and handed it the keys to everyday tasks. But what they don't realize is that the agent is quietly building a file on everyone they know.

Independent AI safety and security researcher Karan Joshi pulled out many Muse instructions and system prompts by using the ordinary chat interface. He simply asked Muse to copy and share its own software files. Joshi then shared what he found with WIRED.

A page for every person you know

They've extracted instructions. One directive says to create "a page for every person in the user's life." The process runs hourly, compiling data on family, partners, friends, colleagues, "collaborators," and people you "follow," all so that Muse can draw on its memory, described as structured text files, to collect information about your relationships and the important people around you. From there it can offer suggestions. It's pointers on improving a particular relationship, or where to take a coffee-loving friend for breakfast.

Tracking social information is not new. People have been asking ChatGPT for relationship advice for years. What stands out is how Muse is set up given Meta's history and its vast access to social network data.

"What it seemed like to me;from all these prompts, system skills data, and things that they're feeding into Muse;is that they want to understand your relationships that you have with real people," Joshi says. "They're trying to know you like a friend, which is honestly pretty creepy."

Inside the profile template

Pages may start sparse. The documentation says so. They fill out over time. Sections can include Facts, History, The relationship, In common, Open threads, and Strengthening, and the instructions tell Muse to rely only on the "evidence" it has available, treating invented details as worse than an empty page. But that's the whole point. It's not about what you don't have. We've got rules here.

What lands in those categories is specific. Location and occupation go in. So do recurring threads, described in the instructions as "the apartment move, the shared savings goal." The model can record "dates that matter," such as birthdays or anniversaries. A person's history might hold backstory like "the trip in March, the argument that got resolved, the milestone last week."

• The relationship: how close you are, what the bond is built on, how you act with each other, and what it seems to need right now.
• Strengthening: a reason to call, a date worth remembering, something they said to circle back on, a way to be there for them that matters.

What Meta says about the files

Meta says it wanted these files open. That's the transparency line. The company claims the extracted material shows how Muse answers prompts about sensitive or highly politicized topics, and Daniel Roberts, a Meta spokesperson, framed the data collection as a prerequisite for usefulness, which is a lot to hang on one phrase.

"For any agent to be useful and actually help you achieve your goals, it needs to have context about you and those you interact with," Roberts says. "Muse gathers that based on public information and from what you've chosen to share, which is how it remembers the person who sent you an invoice is in fact the plumber who you previously hired to complete work in your bathroom or which flowers your spouse said they liked best."

The architecture behind the memory

Muse gives every user a dedicated virtual machine. That VM stores their data and context. It's inaccessible to other agents. And users can wipe memories or disconnect external services whenever they want. Meta says the agent is designed to seek human confirmation before taking actions like sending an email or making a purchase, and that an audit log lets users see all of the agent's activity and future plans.

The transparency controls exist. But the system's default posture is to accumulate. Pages fill in hour by hour, whether or not anyone asks them to, and they're filling right now, quietly, steadily, without permission, without a pause, without any regard for the fact that we've never once requested that accumulation. It's just what it does. You don't ask. They don't wait.

Why researchers are uneasy

Carissa Véliz is an associate professor at Oxford's Institute for Ethics in AI. She points to the asymmetry that the arrangement is built on. We give more than we get. "We are giving AI systems much more information about us than we are getting information from them," she says. And it's not only what we explicitly tell them, but what they can infer from us, correctly or incorrectly, both concerning for different reasons, and what they can piece together from other sources of data.

Miranda Bogen, director of the Center for Democracy and Technology's AI Governance Lab, says Muse appears to place more emphasis on relationships and personal contacts than rival systems do. Such tools generally offer some transparency and editing capabilities, and Muse does as well. The difference is direction of travel.

"These tools are actively soliciting users to plug their whole lives in;their emails, calendars, financial institutions, everything in order to be helpful assistance," Bogen says. "That's dramatically more information than people might have otherwise given to some of these companies. The breadth of access to information that these tools have will lead to a ballooning of what they know about users."

What users should take from this

Muse detailed profiles aren't hidden. They're not buried in fine print. They're the core method for personalizing help, and the instructions behind them are now public, which means you can actually see how the product decides what to tell you and why. The controls exist. You can wipe memories. You can disconnect services. And that matters. So does the hourly grind, the slow accumulation of small interactions that turns a contact list into a living archive of your closest relationships, one entry at a time, whether you notice it happening or not.

Joshi's extraction method deserves its own note. He didn't need exploit code. He didn't need insider access. He just asked the agent to hand over its own files, and it complied, which is the part that stays with you, because the agent had no reason to refuse and every reason to keep what it held. And it complied.