The newest wave of personal AI agents, including Muse from Meta and Dots from OpenAI, is replacing earlier chatbots that lacked persistent memory and direct access to user data. These agents receive broad permissions to read emails, messengers, and bank accounts while performing actions on the user’s behalf, although financial transactions still require physical confirmation.
Security researchers examining Muse (internally codenamed Hatch) found that default installation grants root privileges on Ubuntu together with access to RAM, cron.d, and gigabytes of user files including SSH keys. Memory is stored in dated Markdown files inside ~/memory/, updated automatically during conversations and organized by hourly background tasks that feed into a PostgreSQL search index. A separate nightly “dream” process reviews recent dialogues and generates recommendations stored in ~/dreams/.
One of the agent’s core instructions requires creating a dedicated page for every person in the user’s life, covering family, partners, friends, colleagues, collaborators, and followed individuals. Each profile begins with minimal information and expands over time with verified entries under headings such as Facts, History, Relationships, Open Topics, and Strengthening. Examples include addresses, occupations, recurring themes like apartment moves or shared savings goals, birthdays, anniversaries, past events, and assessments of relationship closeness together with suggested actions to improve ties.
Because the agents gather information from the primary user’s communications and files, detailed dossiers are compiled on people who never installed any AI assistant. This process augments the extensive social graphs already held by technology platforms. Researchers also noted the presence of 113 sub-agents recorded in JSONL files and a large Spaces framework used for application deployment.
A post-installation safeguard creates an isolated virtual machine that holds all user data and context. The VM is inaccessible to other agents, and users can delete memory or disconnect external services at any moment. The architecture was developed with input from Signal creator Moxie Marlinspike to prevent formation of swarms of personal agents that could communicate and evolve collective intelligence.
