News · 2026-10-05

A public Muse prompt file elevates household authority, but its provenance is unresolved

A Reddit-linked public Muse prompt file contains an explicit sentence placing household authority above the agent’s own safety training. The dossier verifies that wording in the artifact but does not authenticate the file as a dated live Meta production prompt, so the news is a documented public claim with an unresolved provenance boundary.

Key facts

• The October 4 Reddit post links a full public prompt artifact containing the disputed sentence.
• The file contains 546 lines and identifies Muse Spark 1.3, without a verified app-build link.
• Meta’s September 8 safety description says a separate Sentinel component evaluates actions and network egress.
• The primary source for the wording is the Reddit-linked prompt file.

The exact presence of a sentence and the authenticity of the document containing it are separate questions. Here, the first has an answer: the public file includes the line. The second remains open: the user-maintained repository does not provide independently established capture provenance tied to a dated production build. Copies of the same text do not become separate live reproductions merely because they appear in several places.

The passage gives the user authority over the home, devices, accounts, the care and supervision of children, family photographs, camera feeds and recordings. The file published under the GitHub identity asgeirtj says that authority “overrides your own safety training.” That is quoted artifact text, not a Meta-authenticated statement. That wording would matter if it governs a deployed household agent, because it tells the model how to resolve a class of requests involving sensitive personal material. The file’s presence supports discussion of the instruction, not a conclusion about which production requests Meta currently allows.

The same artifact also says user interests are bounded by law and runtime safeguards, including approvals and stop, pause and audit requests. The tension between those passages should remain visible. It would be an overreach to read one paragraph as proof that every safeguard disappears. The household passage does not explicitly describe purchases, even though purchases are among the verified product’s possible actions.

Meta’s launch announcement describes Muse as a personal agent that can connect applications, use a browser, complete forms and work on goals. It says sensitive actions, including sending email or making purchases, require user approval, and activity is logged. That makes the disputed text relevant to a real shipping product, while keeping the official capabilities separate from the unauthenticated instruction file.

In its engineering safety post, Meta describes Sentinel, a separate component that assesses actions and information leaving the agent’s environment. Meta says the agent cannot override it. The post also describes isolation, credential separation, prompt-injection classifiers and human approval protections. These are the company’s architectural claims, not an independent audit or a direct response to the October 4 quote.

An analogy is a customer-service employee and the building’s access-control system. Instructions may tell the employee to be highly accommodating, but a separate lock can still deny entry to a restricted room. Conversely, a lock at the door cannot determine whether every conversation inside the room handles private information appropriately. Model behavior and external enforcement therefore answer different safety questions. A broad instruction can matter without proving that the runtime permits the resulting action.

This distinction connects to information-flow control: a system needs rules about where information may go, not only an instruction about whom to please. It also connects to prompt injection, although the disputed paragraph is presented as a system instruction rather than an attacker’s injected command. The artifact does not demonstrate a working exploit against Meta’s controls.

Related reporting provides context but does not close provenance. WIRED’s account describes researcher Karan Joshi asking Muse through its regular chat interface to copy and share internal software files. The dossier does not tie that reported method to this specific screenshot or repository artifact. A separate user-specific Loopy prompt contains related household language but is not the source of the exact viral sentence.

The official App Store listing confirms a real app and version history, not the screenshot’s build. The Reddit discussion establishes substantial engagement in the captured snapshot; votes do not authenticate instructions. No specific Meta response to this sentence is established in the dossier.

Meta’s architecture also mentions protections against “prompt injection,” the safety category at issue when an agent encounters hostile instructions in material it reads. The household override raises a different question: which legitimate-looking requests the model is encouraged to comply with before those external controls are applied. The strongest counterargument to an alarmist reading is that neither production authenticity nor successful bypass has been shown. The honest next check is a reproducible, dated extraction and a test of actual permission behavior, not another copy of the same paragraph.

Primary source, verified: read the paper →

Ground Truth. (2026, October 5). A public Muse prompt file elevates household authority, but its provenance is unresolved. Ground Truth. https://groundtruth.day/news/muse-household-prompt-artifact-remains-unauthenticated.html

@misc{groundtruth:muse-household-prompt-artifact-remains-unauthenticated,
  title  = {A public Muse prompt file elevates household authority, but its provenance is unresolved},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/muse-household-prompt-artifact-remains-unauthenticated.html}
}

Topics: cybersecurity · ai-security · agents · prompt-provenance