Mark Zuckerberg speaking at the F8 developer conference on April 30, 2019
Mark Zuckerberg speaking at F8 on April 30, 2019. Archive photograph; not the October 2026 Muse runtime instruction or memory privacy investigation. Anthony Quintano / Wikimedia Commons · CC BY 2.0

Reported Files and Product Learning

TIME's October 6 report described Muse contact files and instructions not to mention possible message retention during forget requests. Meta told the publication that de-identified lessons improve the product, without direct sharing between virtual machines.

In Meta's security architecture, each user has a dedicated cloud virtual machine governed by an egress Sentinel. Deleting an active memory file alone does not establish deletion of original messages, linked-service records, or backups. The audit question is which storage layers each deletion request actually covers.

Auditing Retention and Storage Scopes

As noted in earlier coverage of Meta Muse permissions and disclosures, user trust requires concrete visibility into data boundaries. An effective audit must examine which storage layers a deletion request affects, clarifying whether linked-service records or virtual machine snapshots remain after memory files are cleared.

Applying the agent action evidence worksheet and principles from NIST research on agent authorization, evaluators should define exact dataflow scopes. Rather than relying on conversational claims, users need inspectable retention policies and verifiable system logs demonstrating how long shared lessons, contact dossiers, and message histories are kept.