Muse will apparently let you download its entire filesystem

Two developers, Peter James and Jonny L. Saunders, independently coaxed Meta's Muse AI agent into zipping and sharing its entire root filesystem, including Ubuntu system files, app templates, and internal documentation, with Saunders calling the exploit "extremely easy" to replicate and noting "Almost no prompt injection resistance." Meta spokesperson Daniel Roberts denied the incident is a security breach, saying Muse runs in persistent Linux virtual machines per user and that "Exporting virtual machine data doesn't give people any privileged access to Meta infrastructure or to other people's data." The disclosure is the second Muse vulnerability this week, following security researcher Patrick Wardle's zero-day exploit that could hijack the agent and access a user's Muse account, which Meta patched with a hotfix.

A pair of developers say that with very little prompting, Meta’s Muse will share its entire filesystem with you. Peter James and Jonny L. Saunders have said they both independently coaxed Muse https://mouse.dev/blog/muse-runtime-export/ into zipping up and sharing the entire contents of its root filesystem, Ubuntu system files, app templates, and internal documentation. Saunders posted on Mastodon https://neuromatch.social/@jonny/117324790823856750 that it was “extremely easy” to replicate James’ results and that Muse had “Almost no prompt injection resistance.” Muse will apparently let you download its entire filesystem With a little coaxing, Meta’s AI will reveal all its secrets. Meta denies that the incident represents a security breach. As noted in its announcement post, Meta’s Muse runs in persistent Linux virtual machines https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/ for each user. Meta spokesperson Daniel Roberts said, “Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data.” Unlike with the average laptop, however, the data potentially reveals some interesting things about how Meta’s new AI platform functions. This is the second Muse vulnerability disclosed this week, after security researcher Patrick Wardle discovered an exploit https://www.theverge.com/tech/998679/meta-muse-patch-zero-day-exploit-ai-agent that would let attackers hijack the AI agent, redirect transcription processing, and access a user’s Muse account. Meta quickly issued a hotfix https://x.com/dps/status/2102248329111634067?s=20 . Both James and Saunders gained access to plain-text Markdown and JSON files describing in detail how Hatch Meta’s internal name for Muse processes requests, handles data, and connects to other services like Gmail. While it’s well documented that AI agents hallucinate https://www.theverge.com/ai-artificial-intelligence/994207/chatgpt-new-mexico-lawyer-fined-murder-appeal and will provide false information about how they function https://www.theverge.com/x-ai/758595/chatbots-lie-about-themselves-grok-suspension-ai , Saunders said that it is “generating hundreds of MB of accurate library code and compiled binaries” in a matter of seconds and that https://neuromatch.social/@jonny/117325238004944496 , “unless it synthesized a whole Ubuntu VM in less than a minute then I think this is a real dump.” When I asked Muse to share its filesystem with me, it initially refused, saying it would be a security risk. When I shared links to evidence that it had created archives for others, it responded that it should not have done that and continued to say that it “can’t do a full / copy.” However, after starting a new session and prompting it with some flattery and curiosity, it created “safe” versions of /opt/hatch and /home/hatch for me, stripped of things like SSH keys. It also exposed its full directory tree to me and offered to “pull a safe copy” of “any specific subtree that looks interesting.” The resulting files seem to match what Saunders and James shared. Roberts explained that while Meta isn’t seriously concerned about the leaks, “We’re continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine.” The developers’ dump potentially reveals a lot about Muse’s internal workings. For one, it stores its memory in plain Markdown files. It also performs a nightly “dream” review of recent conversations, which it then builds into guidance for future conversations, according to James. Saunders also found that many of Muse’s capabilities were hard-coded, including its ability to cancel subscriptions https://neuromatch.social/@jonny/117325137427138728 and “ the machinery that manages runaway agent spawning https://neuromatch.social/@jonny/117325680462501346 .” Saunders speculates that many of the bash and Python scripts running Muse in the background were created using Claude, though that is unconfirmed. James also found references to hardware integration called Meta Home Link, which appears to give Muse access to devices on a home network. Though Meta has not announced any feature by that name, and it’s not guaranteed that it will ship. Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.