Social RocketInternal instructions for Meta's personal AI agent Muse show how far long-term personalization can go: the system is designed to build structured pages about people in a user's life – such as family, friends, colleagues and other contacts. It can store facts, shared history, open topics and notes on what matters in each relationship.
The documents were extracted from Muse by security researchers and analysed by WIRED. Meta says Muse forms these connections based on public information and the data users themselves share. Crucial for context: Meta explicitly states that Muse conversations and the data in the personal Muse VM are not passed on to Meta's advertising systems.
Muse is meant to understand relationships over time
According to the internal instructions analysed by WIRED, Muse can create its own structured pages for people around a user. These can start out very brief and grow over time with additional context.
Areas mentioned include facts, shared history, the relationship itself, commonalities or open topics. Birthdays, earlier conversations or details that could be useful for later suggestions can also become part of this memory.
The distinction between documented function and interpretation matters here: according to WIRED, the instructions require Muse to work on existing evidence and not to invent missing information. The system is therefore not supposed to deliberately fill gaps with speculation.
Meta officially describes the same basic idea less technically. Muse should remember details a user may have mentioned only once, so the agent can later make suitable suggestions on its own – for example when planning a meal or with tasks involving friends and family.
Why this goes beyond classic chatbot memory
Personalized memory is no longer an unusual feature for AI assistants. With Muse, however, it becomes a much broader product model: the agent can be connected to email, calendar, Instagram and other services, work in the browser and continue tasks even after the app is closed.
This creates a different privacy context from an isolated chatbot. Not only individual statements can become relevant over the long term, but also information from connected services, recurring tasks, social relationships and the patterns derived from them.
Meta built Muse precisely for this persistent way of working. The agent runs in its own Muse Secure VM, a dedicated virtual machine per user. Connected services can be enabled or disconnected individually. For sensitive actions such as sending an email or making a purchase, Muse is meant to ask for confirmation and make all activity visible in an audit log.
Srocket has already placed the technical direction in context with the Muse deployment for small businesses and agentic commerce with Shopify and other services. The more services an agent is actually allowed to operate, the more important it becomes which context is stored permanently.
No evidence that these profiles feed into ad targeting
With Meta in particular, it is tempting to suspect that personal AI data is directly linked to the advertising business. For the Muse profiles described here, however, there is no proven evidence of this.
Meta states explicitly in its official Muse documentation that conversations with Muse and the data inside the Muse Secure VM are not shared with the company's ad systems. Users can disconnect linked services, delete stored memories, and opt out of having their interactions used to train Meta AI models.
This assurance should not be confused with the claim that Muse processes only little data. On the contrary, the product's value comes precisely from the agent knowing as much relevant context as possible. The core privacy conflict therefore lies first in the scope, duration, and control of personalization, not in any proven sharing of data with ad targeting.
Meta also plans a Muse Confidential VM, in which the entire virtual machine, including data and conversations, would be encrypted with a key only the user holds. According to Meta's description, even the company itself could then not access this content.
Personal AI agents shift the privacy question
For platforms and marketers, Muse is an example of how the value of data is changing in the AI era. For social networks, the observation of clicks, interests, and interactions long stood at the center. Personal agents, by contrast, become useful when users actively give them deep context about everyday life, contacts, appointments, purchases, and goals.
This also changes expectations around governance. When an agent models relationships and keeps learning over months, traceable storage logic, deletion options, clear access rights, and genuine separation from other business systems become more important.
Meta already raises similar architecture questions with Private Processing for AI Glasses. At the same time, the company is increasingly integrating Muse into business workflows via its Enterprise Platform.
For brands, the practical rule to draw from this is above all: an AI agent should only access data and systems it truly needs for its task. The more personalization becomes a product feature, the more important traceable data minimization becomes.
What users can control
According to Meta's current documentation, users can determine which apps Muse may connect to and which actions the agent can perform in those services. Connections can be removed again. Before sensitive actions, Muse is meant to ask for confirmation, display an activity log, and, on request, forget individual memories.
The internal instructions published by WIRED make visible how extensive such a memory can become technically. Meta's counter-position is not that Muse stores little, but that users keep control and that agent data remains separated from advertising systems.
Whether this balance holds in practice is therefore becoming one of the most important questions for personal AI agents overall.