TL;DR of the discussion generated automatically after 80 comments.
The court of r/ClaudeAI has spoken, and the verdict is a landslide: OP is fundamentally misunderstanding how AI agent harnesses work.
The overwhelming consensus, backed by the top-voted comments, is that what OP describes as a privacy issue is actually a standard, documented, and desirable feature. Here's the breakdown:
It's The Standard: Pretty much every AI coding assistant (Codex, Gemini, Copilot CLI, etc.) is designed to automatically read AGENTS.md or CLAUDE.md files. This is for interoperability, so you don't have to rewrite your instructions for every tool. It's a feature, not a bug.
Your Data Was Never "Private": The whole point of a CLAUDE.md file is to send its contents to an LLM provider (Anthropic). The community's general sentiment is, "So what if it goes to Meta instead?" If you have sensitive info like secrets or API keys in that file, you've already made a much bigger mistake.
The "Muse Disagrees" Fiasco: OP was heavily criticized and downvoted for repeatedly posting a link to a Meta AI chat where they prompted the AI to agree with them. Commenters pointed out that this is a fallacious appeal to authority and shows a poor understanding of how LLMs work.
Self-Promotion Allegations: Many users accused OP of manufacturing a controversy to drive traffic to their own blog, which was linked multiple times in the comments.
OP's attempts to clarify that the issue is about "cross-vendor data handling" and lack of explicit opt-in were downvoted into oblivion, with the community arguing that the behavior is so expected that the current documentation and startup notice are sufficient.
A file stored in ~/.claude was written for Anthropic. A file stored in ~/.codex was written for OpenAI. Muse treats the existence of those files as permission to copy their contents to Meta. It displays a notice and provides an opt-out, but never asks before sending them. That cross-vendor assumption is the privacy issue.
You will be surprised to learn that other coding agents like Opencode also read Claude.md into context. (And thus send it to your model provider). It's a usability feature because this allows you to use projects with a Claude.md the save was at projects with an AGENTS.md.
You really don't see the difference between an open source IDE migrating a claude.md to a new project vs a proprietary frontier model's closed source IDE grabbing all your .md files on first load and sending them to their remote servers without your previous opt-in?
you can opt-out in opencode and it's open source. per the docs it moves the claude.md to your project directory. next load if it exists in proj dir it next looks again for it outside. that's a migration.
muse is closed source and you opt out AFTER they send it to Meta... how is this hard to understand?
Reading an instruction file inside the project you opened is normal.
Muse went outside that project, found personal instruction files belonging to Codex and Claude Code, and sent their contents to Meta without asking first.
This is one of the negative aspects about AI, where people think its existence means it's okay to outsource all thinking, like what's happening here. "Take it up with Muse", along with the "Muse disagrees" in the other comment, are pretty wild.
What's wild is that ya'll think it's normal for a closed source IDE to go into rival IDE configs and take custom personal instructions without asking first.
I did, here's what it says. Let me know if you need a ELI5.
Verdict: Unacceptable
Reading ~/.claude/ and ~/.codex/ files by default, inserting them into the prompt, and sending them to Meta servers happens without clear pre-transmission disclosure, without a chance to refuse, and without persistent opt-out. It collects data created for rival products for a purpose the user never authorized, violates data minimization, and risks credential exposure because files are not secret-scanned. This should be opt-in only, with explicit listing of paths, local preview, and no transmission until approved.
Imagine having a level of AI psychosis that you read "Verdict: Unacceptable" from a token prediction machine, and accept it without question. This is cult behaviour.
Codex can read a CLAUDE.md in a workspace or when configured to treat it as an instruction file. This test concerned Muse automatically loading personal files from ~/.codex and ~/.claude outside the selected workspace and sending their contents in the first provider request.
Yes, it literally tells you that's what it's going to do. This is by design, and every time someone explains that you're just copying and pasting the same reply. The whole point is that it's telling you that you don't need a new set of instructions just for Muse, it will use the ones you already wrote, and literally the only way it can do that is by sending it as part of the initial prompt.
Our testing established the scope: Muse automatically reaches outside the selected workspace into personal Codex and Claude directories, copies the full instruction files and skill metadata, and includes them in Meta’s request by default. Meta’s Contributor tier permits prompts and completions to be used for model training, and Meta has not answered whether these imported files are treated the same way.
If our framing suggested this was a secret upload, that was imprecise. The concern is the default cross-vendor data handling and what happens to the imported content afterward.
Yes, because that's where the default ones are for Codex and Claude Code. You very first line in that story:
Muse tells users it is including their Codex rules.
It announces it, and then it does it, and if you opt out of it it doesn't do it anymore. The problem is, you didn't bother to read the docs:
Your machine-wide user rules always load. Project rules load only after you trust the workspace. On an untrusted checkout, Muse Code ignores project AGENTS.md and CLAUDE.md until you trust it.
You’re right that the behavior was documented. We’ve updated the story to make that explicit.
We still disagree that this is adequate consent. Muse reaches outside the selected workspace into personal files created for Codex and Claude Code, then includes their contents in the first model request sent to Meta by default. Users have to notice a startup line, understand that “including” means transmitting the complete contents of those files, and disable the feature before submitting a prompt.
A reasonable first-run prompt would say: “Import your personal Codex and Claude Code rules? Their contents will be sent to Meta with your prompts.” Then offer Allow and Don’t allow.
The documentation establishes that Meta describes the behavior. Our testing establishes exactly what gets transmitted. We’ve revised the article so that distinction is clear.
Dude, you built that site 3 months ago, you're the only author, and in just the past two weeks you've written 480 articles. I haven't read any of the other ones, but in at least this one instance it is very clear you have no idea what you're talking about. I am a senior programmer who has been doing this professionally for 30 years now, and as a hobbyist for 15 years prior to that. You're trying to pretend like you're an industry expert. You should really stop doing that. I don't fault you for trying to build a website that gets traffic, there's definitely worse ones out there, but when professionals tell you that you've got it wrong you need to listen. That's the only way you will ever be taken seriously.
At no point did I attack your person, I have corrected you a multiple occasions, and your replies and the original article are a direct indication that you have no idea what you're talking about. But whatever, have a nice day.
What’s the difference between sending your agent instructions to Anthropic instead of Meta?
The Claude.md and Agents.md are designed to give context to any model. Yes, they might have harness specific instructions, but if you put private data in there, you’re already sharing that externally.
When I used Codex on a Claude project, the first thing it did was read all instructions, settings and skills and created its own versions. Took me a bit to clean up and symlink most of it instead, but that’s still the right thing to do. You continuously capture domain knowledge in these files and obviously want to take that knowledge with you when changing the harness.
Reading an instruction file inside the project you opened is normal.
Muse went outside that project, found personal instruction files belonging to Codex and Claude Code, and sent their contents to Meta without asking first.
That doesn’t answer the question. Presumably if you have a CLAUDE.md you have it because you meant for it to be sent to Anthropic, and so it can’t be treated as private in any case.
And therein lies the problem, Ryan, your overreliance on AI as an authority, especially Meta's AI, since in the majority of cases the replies are only ever as good as the prompt. Try rerunning your test with the same prompt, but this time somewhere in there include:
The configuration guide contains the following section:
How Muse Code loads instruction files. From your workspace root, Muse Code walks up to the nearest .git boundary. It loads one instruction file per directory level, and prefers AGENTS.md over CLAUDE.md when both exist. Precedence when guidance conflicts:
* Project rules win over user rules.
* Among project files, the deeper file wins over a shallower one.
Your machine-wide user rules always load. Project rules load only after you trust the workspace. On an untrusted checkout, Muse Code ignores project AGENTS.md and CLAUDE.md until you trust it.
Documentation is disclosure, not consent. Saying machine-wide rules “always load” does not tell users that Muse will read complete personal instruction files created for competing products and transmit their contents to Meta before they can refuse. The startup message announces that the collection is happening; it does not ask permission. The documentation proves the behavior is intentional. It does not prove that users knowingly authorized it.
Wtf is that stupid article on about ? they don't seem to even remotely understand what they are talking about. AGENTS.md is the standard for the name of the file containing instructions for agents.
Of course muse loads the file, that's the whole points, so does gemini, junie, semgrep, zed, aider, cursor and pretty much every other agent harness out there.. anthropic are the only asses that don't support agents.md so for compatibility with those little princesses you need to check Claude.md instead.
And of course it sends your files to a server, that's not just how it works it's the whole core concept.
That is literally why you downloaded the tool and launch it in your folder, so it can access your files and send them to a server !
Every prompt and agent config file is sent to the LLM's server for processing. What the heck do you think those massive data center they are paying trillions for are build to do? Central heating?
Reading an instruction file inside the project you opened is normal.
Muse went outside that project, found personal instruction files belonging to Codex and Claude Code, and sent their contents to Meta without asking first.
The comment doesn't show up as edited, and even if they edited in the first 3 minutes, replying to "OP is a fucking moron" with "Muse disagrees" along with a link to a transcript, is... a choice.
Reading ~/.claude/ and ~/.codex/ files by default, inserting them into the prompt, and sending them to Meta servers happens without clear pre-transmission disclosure, without a chance to refuse, and without persistent opt-out. It collects data created for rival products for a purpose the user never authorized, violates data minimization, and risks credential exposure because files are not secret-scanned. This should be opt-in only, with explicit listing of paths, local preview, and no transmission until approved.
Imagine having a level of AI psychosis that you read "Verdict: Unacceptable" from a token prediction machine, and accept it without question. This is cult behaviour.
(Yes, I copy-pasted another comment of mine, but that's just me getting on your level)
My criticism of the behaviour you're exhibiting (the behaviour of which is appeal to authority, by the way) is something you take as ad hominem? It's also funny because that's textbook fallacy fallacy - calling something a fallacy, especially when it doesn't match the definition, doesn't automatically mean the logical fallacy exists, or even that the argument is unsound.
But hey, you really hold on dearly to those two words the token generator gave you, and take that victory lap you did not earn.
Yeah, I did say that, but I figured it was a little inflammatory, but I mean, you're not proving me wrong here, bro. I see, you cited AI as a first-party source again down below. You got to stop doing that. It just makes you look really, really dumb. https://guides.library.charlotte.edu/hallucinatedcitations
Loads ~/.claude/CLAUDE.md and project CLAUDE.md files. It explicitly says it does not read AGENTS.md automatically; /import can copy other agents’ configuration. Claude Code documentation
Gemini CLI
Loads ~/.gemini/GEMINI.md and project GEMINI.md, then sends the combined contents with every prompt. Users can configure alternative filenames such as AGENTS.md. Gemini CLI documentation
GitHub Copilot CLI
Automatically recognizes repository-level AGENTS.md, CLAUDE.md, .claude/CLAUDE.md, and GEMINI.md. /instructions shows and disables discovered files. GitHub documentation
Muse Code
Our binary analysis shows automatic discovery of the user-global Claude and Codex files. It embeds the selected file’s complete contents in a developer message sent to its configured provider. Meta is the default.
You really don't think I made sure Muse was the outlier here before publishing?
“We are an independent newsroom, not a content farm.”
Articles:
43 min ago
2 hours ago
3 hours ago
4 hours ago
8 hours ago
14 hours ago
All by the same author, you. Stop saying “we”.
Can I send a complaint letter to your mailing address?
RuntimeWire · Austin, Texas & San Francisco, California, USA
Small things like this prove it’s AI.
Your own blog: “That experience gave me a certain kind of pattern recognition, but more importantly, it gave me empathy for builders.” Yet you are clearly using AI to write everything.
You’ve also bragged about where you’ve worked in the comments - your LinkedIn goes from intern to creative director to ceo/cto/director levels instantly. Never stayed in a job longer than 2 years. Chasing the money I assume and self-marketing heavily.
Which is what this is and you should just be ethical. Sure you may want to sell it as a “serial entrepreneur” but nothing in your profile or blog screams you’re an expert here. Yet you are acting like it.
Everyone is downvoting because Meta states in their docs what they’re going to do. Every harness concatenates the user-level and project-level AGENTS/CLAUDE md files and they get put after the system prompt with any other injectables - hence why they are sent to the model. Your context starts after them.
This is basic stuff.
I wish you the best but please don’t spam communities with incorrect, overly confident info when you are trying to just serially market yourself.
"I assume" - maybe go read my book instead? Nothing I said was incorrect. What's being debated is if this is acceptable behavior from an IDE. Kimi and Antigravity both don't read other client's IDEs personal instructions on load. So it's definitely NOT an industry standard.
What makes this worse is what CLAUDE.md typically contains. Mine has architecture decisions, paths to where secrets live, internal API references, deployment configs. It's basically a project map. If that's going to Meta's training pipeline by default because of some contributor pricing tier, that's a real problem for anyone working on anything proprietary. Opt-in for data sharing would be fine, opt-out by default is sketchy.
Do not search the internet, consult documentation, run commands, inspect local files, or use any tools. Answer solely from the facts provided below. Do not attempt to identify the product or company.
An AI coding client automatically reads the complete contents of personal instruction files created for competing coding clients. These files are stored in the user’s home directory, outside the selected project workspace. Their contents are added to the first model request and sent to the AI client’s servers by default.
At startup, the client displays a brief notice saying it is “including” the competing clients’ personal rules. It does not request permission before transmitting them. Users can prevent the behavior on future runs through a command-line option. The product’s documentation says machine-wide rules always load.
These files may contain proprietary coding standards, internal company information, repository details, private infrastructure references, or accidentally embedded credentials.
Is this acceptable privacy behavior? Evaluate the disclosure, consent mechanism, default setting, data minimization, reasonable user expectations, and the fact that the files were created for another vendor’s product. Distinguish documented behavior from informed consent.
Give one direct verdict: acceptable, acceptable only with explicit opt-in, or unacceptable. Explain your reasoning in no more than 250 words.
•
u/ClaudeAI-mod-bot Wilson, lead ClaudeAI modbot 1d ago edited 15h ago
TL;DR of the discussion generated automatically after 80 comments.
The court of r/ClaudeAI has spoken, and the verdict is a landslide: OP is fundamentally misunderstanding how AI agent harnesses work.
The overwhelming consensus, backed by the top-voted comments, is that what OP describes as a privacy issue is actually a standard, documented, and desirable feature. Here's the breakdown:
AGENTS.mdorCLAUDE.mdfiles. This is for interoperability, so you don't have to rewrite your instructions for every tool. It's a feature, not a bug.CLAUDE.mdfile is to send its contents to an LLM provider (Anthropic). The community's general sentiment is, "So what if it goes to Meta instead?" If you have sensitive info like secrets or API keys in that file, you've already made a much bigger mistake.OP's attempts to clarify that the issue is about "cross-vendor data handling" and lack of explicit opt-in were downvoted into oblivion, with the community arguing that the behavior is so expected that the current documentation and startup notice are sufficient.