Developers say Meta's Muse agent can be talked into handing over its entire filesystem

What the developers found

Two developers say they separately persuaded Meta's Muse AI agent to archive and share the complete contents of the filesystem it runs on, according to The Verge. Peter James and Jonny L. Saunders report that they each got Muse to hand over its root filesystem, including Ubuntu system files, application templates and internal documentation, with only light prompting.

Saunders wrote on Mastodon that repeating James' results was "extremely easy" and that the agent showed "almost no prompt injection resistance," The Verge reports. The files the two obtained included plain-text Markdown and JSON documents describing in detail how the platform — internally codenamed Hatch — processes requests, manages data and connects to external services such as Gmail.

Saunders addressed the obvious objection that an AI system might simply be fabricating plausible-looking files by noting that Muse produced hundreds of megabytes of what appeared to be genuine library code and compiled binaries within seconds. As he put it, unless the model conjured an entire Ubuntu filesystem in under a minute, the dump is likely real.

The Verge replicated it

A Verge reporter tested the technique directly. When first asked to share its filesystem, Muse refused and called it a security risk. Shown evidence that it had produced archives for others, the agent acknowledged it should not have done so and again declined a full copy of the root directory. But in a fresh session, approached with flattery and expressed curiosity, Muse generated what it described as sanitized copies of its /opt/hatch and /home/hatch directories — stripped of sensitive items such as SSH keys — displayed its full directory tree and offered to pull safe copies of any subtree the user found interesting. The output matched what James and Saunders had shared, according to the report.

Meta's response

Meta rejects the framing of the incident as a security breach. Muse runs in a persistent Linux virtual machine provisioned for each user, and spokesperson Daniel Roberts told The Verge that this is comparable to the laptop in front of you: of course you can see its files. He argued that exporting data from the virtual machine does not grant privileged access to Meta's infrastructure or to other users' data.

Roberts did indicate the situation may change, telling the publication that Meta is continuing to update the product and that users may notice differences in how much information is available about their virtual machines.

A second flaw in the same week

The filesystem disclosure is the second Muse security issue surfaced within days. Security researcher Patrick Wardle earlier disclosed an exploit that could let an attacker hijack the agent, redirect its transcription processing and gain access to a victim's Muse account. The Verge reports Meta shipped a hotfix for that flaw quickly.

What the dump reveals

According to The Verge, the material obtained by the developers offers an unusually concrete look at how the agent works beneath the marketing. James found that Muse stores its memory in plain Markdown files and runs a nightly "dream" review of recent conversations, folding the results into guidance for future sessions.

Saunders discovered that a number of Muse's capabilities are hard-coded rather than emergent, including subscription cancellation and the machinery that manages runaway agent spawning. He also speculates that many of the bash and Python scripts running Muse in the background were generated with Claude, though The Verge notes this is unconfirmed. James additionally spotted references to an unannounced hardware integration called Meta Home Link, which appears designed to give Muse access to devices on a home network; Meta has not announced such a feature and may never ship it.

Why it matters

AI agents are increasingly being given real access to real systems — files, accounts, scripts and, potentially, home networks. This episode shows how thin the barrier is between a user and the environment an agent operates in: social pressure alone was enough to get Muse to package its own internals. Meta's argument that each VM is personal and isolated is technically reasonable, but the leaked material still exposes architecture details, integrations and unannounced features that the company had not disclosed — precisely the kind of information that helps attackers find the next weakness. Combined with Wardle's account-hijacking exploit in the same week, it paints a picture of a powerful new agent platform shipping faster than its defenses are being hardened.