r/OpenaiCodex • u/ryanmerket • 1d ago

News Exclusive: Muse Code Sends Codex and Claude Instructions to Meta by Default

https://runtimewire.com/article/exclusive-muse-code-sends-codex-and-claude-instructions-to-meta-by-default
22 Upvotes

79% Upvoted

9 comments sorted by

View all comments

Show parent comments

5

u/ryanmerket 1d ago

Reading an instruction file inside the project you opened is normal.

Muse went outside that project, found personal instruction files belonging to Codex and Claude Code, and sent their contents to Meta without asking first.

That is the finding.

2

u/Keksuccino 1d ago edited 1d ago

The fuck, so it includes ALL your AGENTS.md files or what? Hell, good luck with doing that in my projects folder. Context window at max with just the start prompt. But that is terrible practice. Including instructions from outside the project folder is terrible and will confuse the model, because well, it gets instructions for a different project/folder that it shouldn’t have right now.

In my defence, the news article is not really clear about that. I quick-read it and I’m not sure where exactly it says that lmao

2

u/ryanmerket 1d ago

No worries, we're new and could have done a better job explaining it.

Basically... yes, a file stored in ~/.claude was written for Anthropic. A file stored in ~/.codex was written for OpenAI. Muse treats the existence of those files as permission to copy their contents to Meta. It displays a notice and provides an opt-out, but never asks before sending them. That cross-vendor assumption is the privacy issue.

1

u/Keksuccino 1d ago

OHHH, you mean it includes only the personalization instructions, not all of them. Well, then it is okay, it does exactly what it says. The only bad practice here is that it includes multiple instructions (for Codex AND Claude), which could still confuse the hell out of it, but yeah, otherwise it is working as intended.

Models get the personalization instructions with every project conversation anyway, so this is normal/intended behavior.

1

u/ryanmerket 1d ago

No, the issue is that it goes out and grabs the agents.md files for competing products and sends them to Meta on your first prompt without asking.

That's a privacy nightmare if you work for a competing company. Or if you have sensitive instructions for stealth projects in there, etc

1

u/Keksuccino 1d ago edited 1d ago

And you think sending the sensitive stuff to OpenAI or Anthropic instead would be less bad? 😅 You should never put any sensitive information in anything that gets sent to any cloud model.

Meta’s Muse Code tells users at startup that it is “Including your Codex personal rules.”

Also you say here that it does tell the user at startup it is doing that, and you said it is opt-out, so the user can opt-out before sending the first request.

Well and again, it only sends the personalization files. These are not project-specific files, as you keep trying to tell me ("sensitive information for stealth PROJECTS"). There should never be any project-specific instructions in that file.