Meta's Muse assistant keeps dossiers on loved ones and gets root on Ubuntu by default

Meta's personal assistant Muse (Meta is designated an extremist organization in Russia, and its activities are banned there) keeps “dossiers” on the owner's friends and family and, in a default installation, gets root, i.e. full administrator rights, on Ubuntu. This comes from the first analyses of the agent's files by security researchers. Muse belongs to the second wave of personal AI assistants, which also includes OpenAI's Dots. These assistants read email, messaging apps and bank accounts, and can act on the user's behalf. But they collect data not only about the owner but about everyone connected to them, including people who never installed an assistant.

What was found in the Muse file system

New-generation assistants are replacing chatbots that had no advanced memory and no access to personal data. They continue the line of earlier agents such as OpenClaw and Instinct. Muse's financial operations still require physical confirmation from the owner. Private data collection, however, runs automatically and without separate requests.

The researchers found that in a default installation the agent gets root rights on Ubuntu, plus access to RAM and cron.d, the job scheduler. Gigabytes of user files, including SSH keys, are also open to it. The agent's internal name in the code and documentation is Hatch, and the most interesting material sits in the /home/hatch, /opt/hatch and /opt/hatch-image directories. The agents/ directory contains records of 113 subagents in JSONL format.

The largest part of the program is Spaces, a framework for building and releasing apps. The starter template includes a React client, server actions, a Drizzle schema for SQLite, SQL migrations and a Bun configuration, all in TypeScript.

How memory works: Markdown, hourly jobs and “dreams”

Muse stores its memory in plain Markdown files. Dated files in ~/memory/ record the details of each day, and the agent can update them in the middle of a conversation. Background jobs run every hour: they pull out relevant fragments, sort them by topic and write them to different memory files. PostgreSQL makes these files searchable.

A separate nightly “dreaming” process reviews recent conversations and writes recommendations for future sessions. Older “dreams” are kept in ~/dreams/. According to its description, the memory-deletion system is designed to erase all traces with no possibility of recovery.

Dossiers on loved ones who never gave consent

Another security researcher analyzed the file system independently and found one more detail. One of the instructions requires creating a “page for every person in the user's life.” This is part of the same hourly background process. It collects data on family, partners, friends, colleagues, “collaborators” and people the user “follows.”

A page starts out nearly empty, then fills up with sections titled “Facts,” “History,” “Relationship,” “Shared,” “Open Topics” and “Strengthening.” The instructions say to rely only on real “evidence”: invented details are described as worse than an empty page. The examples include place of residence, occupations, recurring themes such as moving into an apartment or a shared savings goal, as well as birthdays and anniversaries. Events such as a trip in March or an argument that has already been resolved can also end up in a dossier.

Separately, the agent describes how close people are, what their relationships are based on, how they behave toward each other and what, by the agent's assessment, they currently need. The “Strengthening” section suggests reasons to call, memorable dates, topics the people wanted to discuss later, and ways to offer moral support. The official goal is clear: to give relationship advice and suggest places to meet. In practice, though, it accumulates personal information about people who did not agree to be tracked. That information adds to the social graph that corporations have already built from social networks and messaging apps.

What the defense says and where questions remain

For protection, Muse creates an isolated virtual machine (VM) holding the user's data and context. Other agents have no access to it, and the owner can wipe the memory or disconnect external services at any time. By design, this architecture prevents a swarm of personal agents that would talk to each other and form a collective intelligence. The isolated VM was developed with help from the well-known security specialist and Signal creator Moxie Marlinspike.

Isolation protects data from other agents, but it does not answer the question of what an agent is entitled to accumulate about third parties in the first place. The source does not say whether outsiders can see such pages or whether a person can block the creation of a page about themselves. The broad default permissions also raise questions: root access and SSH keys in the standard configuration look excessive for an assistant. Anyone planning to install agents like this should check the installation settings, restrict access to the file system and periodically review the memory directories.