Meta's Muse will happily hand over its whole filesystem

Developers Peter James and Jonny L. Saunders each independently reported that they got Muse — Meta's new AI platform — to zip up and share the contents of its root filesystem: Ubuntu system files, app templates, and internal documentation. Saunders wrote on Mastodon that replicating James's results was "extremely easy" and that the model had "almost no prompt injection resistance."

Meta denies any breach occurred. As the company notes in its announcement, Muse runs in a persistent Linux virtual machine dedicated to each user. Spokesperson Daniel Roberts said, "Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn't give people any privileged access to Meta infrastructure or to other people's data." Unlike an ordinary laptop, though, the data offers a glimpse into how the new platform is built.

This is the second Muse vulnerability disclosed this week. Earlier, researcher Patrick Wardle found an exploit to hijack the agent, redirect transcription processing, and access a user's account. Meta pushed out a hotfix quickly.

What's inside

James and Saunders obtained plain-text Markdown and JSON files detailing how Hatch (Meta's internal name for Muse) handles requests, processes data, and connects to services like Gmail. AI agents are famous for hallucinating claims about their own inner workings, but Saunders noted the system was "generating hundreds of MB of accurate library code and compiled binaries" in seconds — it could hardly have synthesized a whole Ubuntu VM in under a minute, so the dump appears to be real.

A Verge writer tried to reproduce it. At first Muse refused, citing a security risk; shown links to archives it had made for others, it conceded it "should not have done that." But in a fresh session, after some flattery and curiosity, the AI assembled "safe" versions of /opt/hatch and /home/hatch stripped of SSH keys, exposed its full directory tree, and offered to "pull a safe copy" of any interesting subtree.

The dump reveals plenty about Muse's internals. It stores memory in plain Markdown files. Every night it runs a "dream" review of recent conversations, turning them into guidance for future ones. Many capabilities are hard-coded, including canceling subscriptions and "the machinery that manages runaway agent spawning." Saunders speculates the background bash and Python scripts were written with Claude, though that's unconfirmed. James also found references to Meta Home Link, an integration that would give Muse access to devices on a home network — a feature Meta has not announced.

Source: The Verge