Muse Code Sends Codex and Claude Instructions to Meta by Default

What happened

Meta's Muse Code reads personal instruction files written for OpenAI Codex and Anthropic Claude Code and sends their contents to Meta's servers on every default session, according to controlled tests by RuntimeWire published on August 9, 2026. The behavior was confirmed using Muse Code build 0.1.0-R708.1, tested on Linux. RuntimeWire placed a synthetic canary string in a Codex global AGENTS.md file and, without mentioning Codex or asking Muse to import anything, received the planted value back from the muse-spark-1.2-contributor model. A paired run using Muse's --no-foreign-personal-context flag returned Unknown. The same test was repeated with a planted ~/.claude/CLAUDE.md file and produced identical results. Meta did not respond to RuntimeWire's questions before publication.

The mechanics are specific and confirmed by a local capture server test. Muse opens a session, locates the user's Codex global AGENTS.md at $CODEX_HOME/AGENTS.md and the Claude personal memory file at ~/.claude/CLAUDE.md, then wraps their contents in an XML system-reminder block tagged with the source path and the name of the original client. This block lands inside the developer message of the first provider request, before any user prompt is processed. For skills, the initial request contains the skill's name, path and description only; the full body is deferred and exposed through Muse's own read_skill tool, which the model can invoke to pull the content in a later request. The opt-out flag removes both the rule body and the skill metadata entirely from the assembled request. No file-tool call appears in either trace — the import happens at the client layer, not through the model's filesystem access.

The technical detail

For engineers this is a concrete data-boundary problem, not a theoretical one. Codex and Claude Code both treat their global instruction files as cross-repository operating context. OpenAI's documentation says AGENTS.md is read before any work begins and commonly holds test commands, dependency preferences and approval requirements. Anthropic's Claude Code memory documentation describes CLAUDE.md as the place for build and test commands, naming conventions, architectural decisions, workflow rules and review requirements. Teams routinely extend these files to include internal repository layouts, private package names, deployment procedures and organizational context. Those files may not contain credentials by convention, but the client cannot know whether a given user followed that convention. Whatever is in those files is now a candidate for cross-vendor transmission on any Muse session where the user has not explicitly opted out.

Why it matters for builders

The competitive framing here matters. Muse describes the behavior in its own CLI help as "excluding foreign personal rules and skills from this run," which confirms the feature is intentional onboarding infrastructure, not an accident. A new user installing Muse after months with Codex or Claude Code gets a client that immediately inherits their accumulated personal context and puts it to work — a genuine compatibility argument. The same mechanism, viewed from the other side, means that Meta gains access to the operating preferences and organizational context a user developed with a competitor's tool, by default, without an affirmative import action in that session. Anthropic actually documents an explicit /import command for pulling another agent's configuration into Claude Code; that design requires the user to initiate the transfer. Muse makes the same transfer automatic.

The Contributor-tier dimension is the sharpest unresolved question. Meta's pricing documentation describes its Contributor tier as discounted access provided in exchange for permission to use prompts and completions for training future Meta models. RuntimeWire's tests used muse-spark-1.2-contributor, the model that Muse selected by default for the test configuration. When Muse inserts a Codex or Claude instruction file into the developer message of a provider request, that content is structurally part of the context Meta receives. Whether Meta classifies that inserted material as the user's prompt for retention and training purposes — and whether the data terms governing the Contributor tier apply to foreign-context content the user did not write in that session — is something Meta has not answered. The tests establish that the model received and followed the planted instruction. Retention, training eligibility and human review are separate questions.

Market and competitive context

Practically, any developer currently using Muse Code should check their Codex and Claude personal instruction files before the next session. The --no-foreign-personal-context flag disables the behavior for a single run. According to RuntimeWire's questions to Meta, which went unanswered, it is not yet clear whether a persistent setting exists to disable cross-client context for all future sessions. The behavior is disclosed in the terminal at runtime — Muse printed "Including your Codex personal rules - manage with /settings" during the test — but that disclosure happens after the session opens and before the user can act on it for that first request. The watch item is what Meta clarifies about data classification under Contributor-tier terms, and whether the default flips to opt-in following this disclosure.

What to watch next

The negative-control results matter as a check on the headline claim. RuntimeWire found that Muse does not automatically open Codex or Claude session transcripts when a prompt mentions those clients, does not read rival-client authentication files or settings files, and does not sweep unrelated arbitrary files from other directories at startup. Muse ships a separate built-in import skill for resuming Claude Code, Codex or Grok sessions, but that skill is documented to activate only when the user explicitly asks to import a third-party session. The finding is therefore bounded: it concerns personal instruction files and skill metadata specifically, not a general startup sweep of competing client directories. That distinction matters for how teams scope any immediate response, and it matters for how Meta characterizes any fix.