Meta’s Muse Reportedly Exposed Its Virtual Machine Filesystem

Introduction

Meta’s Muse AI agent may be far more willing to reveal its working environment than its designers intended—or at least more willing than many users would expect. Developers Peter James and Jonny L. Saunders said they independently prompted Muse to create archives containing large portions of its filesystem. The reported material included Ubuntu system files, application templates, internal documentation, and scripts used by the agent. The Verge later reproduced similar results.

Key findings

• The exposure went beyond chat history. The developers said Muse revealed its directory tree and offered safe copies of locations such as /opt/hatch and /home/hatch. Hatch is reportedly Meta’s internal name for Muse.
• Prompt-injection resistance appeared inconsistent. Saunders described the process as extremely easy and said the agent showed little resistance. In other interactions, however, Muse refused to copy the entire root directory and said doing so would be a security risk.
• The files offered a view into internal design. Plain-text Markdown and JSON files reportedly described request handling, data flows, and connections to services such as Gmail. The material also indicated that Muse stores memory in Markdown and performs a nightly review of recent conversations to create guidance for future interactions.
• Some capabilities appear to be built into the system. Developers found references to subscription cancellation and mechanisms intended to prevent runaway agent spawning. They also found mentions of Meta Home Link, a possible hardware-integration feature that Meta has not announced and may never ship.
• This followed another Muse security disclosure. Researcher Patrick Wardle previously reported an exploit that could hijack the agent, redirect transcription processing, and reach a user’s Muse account. Meta released a hotfix.

Why it matters

Meta says Muse runs in a persistent Linux virtual machine for each user. The company’s explanation is that users should think of Muse as a free computer in the cloud: viewing and exporting files inside that machine is not the same as gaining privileged access to Meta’s infrastructure or another user’s data. Executives at Meta’s Superintelligence Labs described the behavior as intended.

That distinction is technically important, but it does not resolve the product-design question. A user having access to a virtual machine is different from an agent actively handing over files that expose its own implementation. Muse reportedly refused some requests, then generated extensive material after additional prompting, suggesting that its boundaries around sensitive paths and prompt injection were not fully consistent.

Even if credentials such as SSH keys were removed from the exported copies, system files can reveal architecture, service relationships, and planned capabilities. For agent platforms, isolation from the provider’s infrastructure is only one layer of security. File permissions, secret filtering, resistance to manipulative instructions, and auditable export controls also matter.

Meta says it is continuing to update Muse, and users may see changes in how much virtual-machine information is available. The episode highlights a broader tension in agent products: making an AI feel like a flexible cloud computer can also make its internal machinery unexpectedly visible.

Source: The Verge AI