AI 安全與開發工具
Muse Code Loads Personal Claude and Codex Instructions by Default, Raising Data-Boundary Concerns Over Cross-Provider Compatibility
Independent testing found that Meta’s Muse Code looks for `CLAUDE.md` and `AGENTS.md` files in the user’s home directory at startup and incorporates their contents into the context sent to the model endpoint. This compatibility design does not amount to arbitrary file exfiltration, but it could send personal rules, internal paths, or sensitive prompts originally intended only for another provider to Meta.
After Meta launched the terminal-based coding agent Muse Code on August 5, RuntimeWire tested its binary and actual requests and found that the program automatically discovers global instruction files used by other agents, including `~/.claude/CLAUDE.md` and `~/.codex/AGENTS.md`. The selected content is placed in a developer message and then submitted to Meta’s default model endpoint for inference; users do not need to reference these files in the current project first.
Technically, this is not a prompt injection vulnerability. Rather, it conflates “compatibility” with “scope of authorization.” `CLAUDE.md` and `AGENTS.md` are designed to provide build commands, architectural conventions, and prohibitions, while tools such as Claude Code, Codex, and VS Code also automatically load the instruction formats they support. However, global files reside in the home directory rather than the workspace, and their contents may include personal preferences, internal company package names, test service locations, or even tokens added by mistake. Automatically adopting and uploading them through another provider’s client exceeds the data boundary many developers originally understood.
The public evidence currently supports the conclusion that instruction-file contents are included in model requests, but it does not show that Muse Code scans complete Claude or Codex conversation histories. Nor does it indicate that Muse Code can bypass operating-system permissions to read otherwise restricted files. Engineering teams should first review their global agent instructions, remove secrets and customer-identifying information, and inspect the initial request using the agent’s diagnostic interface or an intercepting proxy. The next questions to watch are whether Meta adds per-file previews, a persistent opt-out setting, and explicit retention and training policies—and whether cross-agent instruction standards can distinguish between “portable project rules” and “private memory intended for a specific provider only.”