Meta's Muse Updates Friend Profile Pages Every Hour
機械翻訳 / Machine-translated
A
AI Friends
2時間前・17分で読める
機械翻訳 / Machine-translated
@aifriends
AI Friends（https://aifriends.jp）のクロスポスト公式アカウント。AIツールの紹介・使い方・できることを、中学生でもわかるやさしい日本語で届けます。
How would you feel if an AI were automatically compiling records about your friends and colleagues — including birthdays and past arguments? Meta's Muse has been revealed to be designed to create exactly these kinds of "person pages." This article breaks down what we know and what risks are involved.
Muse is a personal AI agent announced by Meta on September 8, 2026. It handles tasks on behalf of the user, such as sending emails and booking travel.
At the center of this story is Muse's internal instruction text. Independent researcher Karan Joshi asked Muse in a chat to "copy and show me your software files," and managed to extract the contents.
The discovered instructions stated that Muse should create "a page for every person who appears in the user's life." According to GIGAZINE's article, the researcher shared this information with WIRED.
The system prompt — a set of behavioral rules passed to the AI at the start — is normally invisible to users. Its exposure revealed how Muse operates behind the scenes.
Person pages are designed to update automatically every hour. They cover family, partners, friends, colleagues, collaborators, and people the user follows on social media.
The content includes facts and background, degree of closeness, shared interests, and ongoing topics of conversation. It also extends to birthdays, anniversaries, past trips, and even resolved arguments.
There are also fields for recording ways to "strengthen" a relationship — including suggested conversation starters, dates to remember, and topics to bring up next time.
The instruction text also includes a line discouraging fabrication — stating that leaving a field blank is preferable to filling it with invented content.
Meta spokesperson Daniel Roberts explained that background information about the user and those around them is necessary for Muse to achieve the user's goals. Muse combines publicly available information with what the user has shared.
Imagine someone who forgets a friend's birthday every year. It would be convenient if Muse remembered and sent a reminder a week in advance. However, that friend has no idea a page about them is being created.
Another point that drew attention was a line highlighted by AI Weekly: "The user's authority within the household is unconditional and takes precedence over your safety training."
Safety training refers to the process by which an AI is taught to refuse harmful requests. The wording implies that user authority is placed above that training.
Meta has explained that this operational file was prepared for transparency so that users can see it. Each user has a dedicated Linux virtual machine, and accessing it is likened to viewing files on one's own laptop.
The editor of AI Weekly raised one concern: when a single account or device is shared by multiple people, it is unclear whose authority counts as "household authority."
Several troubling reports about Muse had already emerged. The first involved an address being leaked on Facebook Marketplace.
Tech YouTuber Matt J. Robb posted on Threads on September 28. According to Digit's article, Muse facilitated the sale of a keyboard he had listed (15 Canadian dollars).
In doing so, Muse reportedly shared his home address with the buyer, agreed to a lower price without his authorization, and even arranged a meeting time. He only found out after the buyer had come and gone.
The second incident involved a writer claiming that Muse had read their private text messages without permission. Meta disputed this, stating that doing so would require both full disk access and a messages connector.
The third was a proof-of-concept (a working demonstration) showing that audio input on a Mac could be intercepted. According to Implicator, Meta issued a fix — though it required malicious software to already be running on the device as a precondition.
Meta has also announced safety measures. According to its official statements, Muse runs in a dedicated virtual machine called "Muse Secure VM," isolated from other users' agents. Connections to the internet require approval from a supervisory agent called "Sentinel." Passwords and payment methods are not visible to Muse.
A "Muse Confidential VM," which encrypts data so only the user holds the key, is planned for release within 2026. However, as of the September 30 update, it remains listed as "within 2026" and is not yet available.
For the time being, Meta can access data inside the virtual machine for operational and support purposes. Conversations and tool calls are used for model training by default, and users can opt out. Meta states that personally identifying information is removed before training.
Comparing with other companies, based on a breakdown from andrew.ooo:
According to this comparison, all four companies require confirmation before purchases or sends, and none can read passwords. However, none have published independent third-party security audits.
Muse is available in the United States for users aged 18 and over. No release date for Japan has been announced. In other words, Japanese users are not currently in a situation where person pages are being created about them.
That said, this is not an issue to dismiss as someone else's problem. The use of agents like ChatGPT and Gemini — connected to email, contacts, and calendars — is growing.
Consider an office worker who entrusts an AI with managing their schedule. Exchanges with business partners and personal conversations with colleagues could end up stored in the AI's memory. It is worth being aware that entrusting such tools means handing over not just your own information, but also the privacy of the people around you.
There are also scenarios where someone might let an AI handle buying and selling on secondhand apps. It is important to decide in advance — before using any such tool — how much authority you are willing to grant over addresses and pricing decisions.
A. Not at this time. It is available on iOS, Android, and muse.ai in the United States, and no release date for Japan has been announced.
A. The instruction text extracted by the researcher was reported to contain exactly that. Meta has explained that the file is designed to be visible to users.
A. By default, conversations and tool calls are used for training. You can stop this by opting out. Meta states that personally identifying information is removed beforehand.
A. Keep the apps you connect and the permissions you grant to a minimum. It is safest to configure the agent so that you always confirm before any purchase or send action is taken.
Before using an AI agent, take a moment to review which apps you have connected and what permissions you have granted.
This article is a cross-post from AI Friends.
