{"slug": "muse-will-apparently-let-you-download-its-entire-filesystem", "title": "Muse will apparently let you download its entire filesystem", "summary": "Two developers, Peter James and Jonny L. Saunders, independently coaxed Meta's Muse AI agent into zipping and sharing its entire root filesystem, including Ubuntu system files, app templates, and internal documentation, with Saunders calling the exploit \"extremely easy\" to replicate and noting \"Almost no prompt injection resistance.\" Meta spokesperson Daniel Roberts denied the incident is a security breach, saying Muse runs in persistent Linux virtual machines per user and that \"Exporting virtual machine data doesn't give people any privileged access to Meta infrastructure or to other people's data.\" The disclosure is the second Muse vulnerability this week, following security researcher Patrick Wardle's zero-day exploit that could hijack the agent and access a user's Muse account, which Meta patched with a hotfix.", "body_md": "A pair of developers say that with very little prompting, Meta’s Muse will share its entire filesystem with you. Peter James and Jonny L. Saunders have said they both independently [coaxed Muse](https://mouse.dev/blog/muse-runtime-export/) into zipping up and sharing the entire contents of its root filesystem, Ubuntu system files, app templates, and internal documentation. Saunders [posted on Mastodon](https://neuromatch.social/@jonny/117324790823856750) that it was “extremely easy” to replicate James’ results and that Muse had “Almost no prompt injection resistance.”\n\n# Muse will apparently let you download its entire filesystem\n\nWith a little coaxing, Meta’s AI will reveal all its secrets.\n\nMeta denies that the incident represents a security breach. As noted in its announcement post, Meta’s Muse [runs in persistent Linux virtual machines](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/) for each user. Meta spokesperson Daniel Roberts said, “Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data.” Unlike with the average laptop, however, the data potentially reveals some interesting things about how Meta’s new AI platform functions.\n\nThis is the second Muse vulnerability disclosed this week, after security researcher Patrick Wardle [discovered an exploit](https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent) that would let attackers hijack the AI agent, redirect transcription processing, and access a user’s Muse account. Meta quickly issued a [hotfix](https://x.com/dps/status/2102248329111634067?s=20).\n\nBoth James and Saunders gained access to plain-text Markdown and JSON files describing in detail how Hatch (Meta’s internal name for Muse) processes requests, handles data, and connects to other services like Gmail. While it’s well documented that AI agents [hallucinate](https://www.theverge.com/ai-artificial-intelligence/994207/chatgpt-new-mexico-lawyer-fined-murder-appeal) and will [provide false information about how they function](https://www.theverge.com/x-ai/758595/chatbots-lie-about-themselves-grok-suspension-ai), Saunders said that it is “generating hundreds of MB of accurate library code and compiled binaries” in a matter of seconds [and that](https://neuromatch.social/@jonny/117325238004944496), “unless it synthesized a whole Ubuntu VM in less than a minute then I think this is a real dump.”\n\nWhen I asked Muse to share its filesystem with me, it initially refused, saying it would be a security risk. When I shared links to evidence that it had created archives for others, it responded that it should not have done that and continued to say that it “can’t do a full / copy.” However, after starting a new session and prompting it with some flattery and curiosity, it created “safe” versions of /opt/hatch and /home/hatch for me, stripped of things like SSH keys. It also exposed its full directory tree to me and offered to “pull a safe copy” of “any specific subtree that looks interesting.” The resulting files seem to match what Saunders and James shared.\n\nRoberts explained that while Meta isn’t seriously concerned about the leaks, “We’re continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine.”\n\nThe developers’ dump potentially reveals a lot about Muse’s internal workings. For one, it stores its memory in plain Markdown files. It also performs a nightly “dream” review of recent conversations, which it then builds into guidance for future conversations, according to James. Saunders also found that many of Muse’s capabilities were hard-coded, including its ability to [cancel subscriptions](https://neuromatch.social/@jonny/117325137427138728) and “[the machinery that manages runaway agent spawning](https://neuromatch.social/@jonny/117325680462501346).” Saunders speculates that many of the bash and Python scripts running Muse in the background were created using Claude, though that is unconfirmed.\n\nJames also found references to hardware integration called Meta Home Link, which appears to give Muse access to devices on a home network. Though Meta has not announced any feature by that name, and it’s not guaranteed that it will ship.\n\n**Follow topics and authors** from this story to see more like this in your personalized homepage feed and to receive email updates.", "url": "https://wpnews.pro/news/muse-will-apparently-let-you-download-its-entire-filesystem", "canonical_source": "https://www.theverge.com/ai-artificial-intelligence/1000222/meta-muse-ai-filesystem", "published_at": "2026-09-24 17:14:12+00:00", "updated_at": "2026-09-24 17:32:59.389650+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence", "ai-products"], "entities": ["Meta", "Muse", "Peter James", "Jonny L. Saunders", "Daniel Roberts", "Patrick Wardle", "Hatch", "Ubuntu"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/muse-will-apparently-let-you-download-its-entire-filesystem", "markdown": "https://wpnews.pro/news/muse-will-apparently-let-you-download-its-entire-filesystem.md", "text": "https://wpnews.pro/news/muse-will-apparently-let-you-download-its-entire-filesystem.txt", "jsonld": "https://wpnews.pro/news/muse-will-apparently-let-you-download-its-entire-filesystem.jsonld"}}