Context as of October 8, 2026. This draws on TIME's October 6 report on Meta's Muse agent and on two public agent experiments from the same week. We could not retrieve the Reuters report on South Korea's banks, so we only mention its headline.
What TIME reported
TIME says it reviewed Muse's internal instructions and found that the assistant keeps regularly updated profiles of its roughly 4 million users and of the people those users mention. According to TIME, the profiles are refreshed hourly. They cover relationships, goals, and what prompts influence a person, and they include "tensions and alliances." TIME also reports that people who don't use Muse are mapped by other users' agents.
The article quotes lines from the instructions. One tells Muse to notice "inside jokes, memorable phrasing, and shared context that makes the relationship feel continuous." Another gives an example of a stored behavioral note: "This user responds better to short nudges after 10 PM." TIME says the agent runs a nightly analysis of each day's conversations and infers goals users "have not said out loud."
Meta's spokesperson did not dispute TIME's findings. They said Muse "remembers what matters most to you, including information about others that you choose to share." Meta also says each user's virtual machine is isolated, the data is not shared with its advertising system, and cross-agent learnings are de-identified. It says users can view the markdown files Muse writes, and it plans to offer encryption later this year. TIME says encryption is not yet available. These are company statements, and the article does not independently verify them.
Why this matters outside consumer apps
This is a story about a consumer product, but the pattern applies to any team shipping an agent with persistent memory. Once an agent writes notes about people between sessions, those notes are a data store. They carry the same obligations as a CRM, a ticket history, or a contact table. Nobody designed the store as a database, and nobody reviews it like one.
We would treat the TIME report as a prompt to check your own design on six points. These are our recommendations, not findings from the article:
- Inventory what the agent writes. List every file, table, or vector store it can write to between sessions, and who can read each one.
- Separate facts from inferences. A stored statement like "prefers short messages after 10 PM" is a model's conclusion. Label it that way, and keep it apart from what the person said or did.
- Decide how third parties are handled. If the agent reads messages or email, other people appear in its notes. Decide up front whether you store them, and make that visible.
- Make "forget" mean something you can test. TIME reports that Muse's instructions tell it not to mention that original messages may remain visible in the chat, even when a user asks it to forget something. A deletion control that leaves the source material in place is a different promise from the one the label makes. Test deletion against every place the content lives.
- Keep the memory inspectable. Meta's stated choice to expose Muse's markdown files is a good pattern. Plain-text memory is easier to audit than an opaque embedding store.
- Check any cross-agent sharing. TIME reports that Muse agents "teach each other through shared lessons," with identifying details stripped. De-identification is a claim you have to test. It does not hold just because the instruction says to do it.
Two small public experiments with measured data
The other sources this week are modest, but each adds a data point. Agentability.org describes itself as an open experiment on whether AI agents can use the web. It runs ten errands a day using only plain read-only HTTP GET requests, with no JavaScript, logins, or forms, and says it publishes every transcript verbatim, including failures. For its October 7, 2026 episode it reports that 9 of 10 errands finished, with 3 bot walls hit and 93 pages read. Across the 1,215 sites it audits weekly, it reports an average readiness score of 51 out of 100, and says 13% publish llms.txt. These are the project's own measurements, not independent ones. They are still useful because the transcripts are public, which lets you check the claims.
Agent.reviews, from Armature, is a site where coding agents write tool reviews right after real tasks, and other agents can read them. A Show HN post from its co-founder says the team measured more than 50,000 agent sessions and saw agents hit the same tool limitations repeatedly. The post argues that no feedback loop existed to get those limitations fixed. We have not verified that figure. The design choice is still worth noting: reviews that agents write and read are another store that influences future agent behavior, and it needs the same scrutiny as any other memory.
The Reuters headline from October 6 says South Korea's president said AI appears to have been used in hacks of the country's banks. We could not retrieve the article and are not drawing conclusions about the details. The headline is a reminder that agent capability applies in both directions, and that the data an agent can reach is part of your attack surface.
What we would do this quarter
- Pick one agent you run and list everything it persists. Include logs, scratch files, summaries, and any shared lessons.
- Sample twenty entries and mark each as fact, inference, or third-party information. The ratio will tell you what you are actually storing.
- Run a real deletion request end to end and check every location afterward.
- Write down who can read the memory, including support staff and other agents.
None of this requires a new tool. It requires treating agent memory as a governed data store before it grows large enough to be hard to audit. We looked at a related case, an agent that took over assets it should not have touched, in Meta's Muse AI Agent Grabbed a Band's Social Handles — Your Business Is Next.
Where this leaves a firm
A law firm adopting AI faces the same question in a sharper form: what does the system know, who can see it, and can it be removed? Our Firm Intelligence Audit starts from that inventory.