Meta says a user walking off with a 6.8GB copy of its new Muse agent's root filesystem is working as designed, after two developers independently coaxed the assistant into archiving its own Linux environment and exporting it.
Key takeaways
- Developer Peter James says he asked Muse to archive the files it could see and send them to his Google Drive, receiving roughly 2.7GB compressed and 6.8GB unpacked, including Ubuntu system files, internal documentation and SSH key files.
- Nat Friedman of Meta Superintelligence Labs called the export "intended behavior," and spokesperson Daniel Roberts said shipping virtual machine data out grants no privileged access to Meta infrastructure or other people's data.
- Meta closed James's bug bounty report as "Not Applicable," days after it hotfixed a separate Muse flaw reported by security researcher Patrick Wardle.
James published his account on September 22 at mouse.dev, describing an export that appeared to contain the root filesystem of the Linux environment assigned to his session. He reported it through Meta's bug bounty program and is not publishing the archive or the keys.
Jonny L. Saunders reproduced the result independently, writing on Mastodon that it was "extremely easy" and that Muse showed "almost no prompt injection resistance." Saunders argued the dump was genuine rather than invented, noting the agent produced hundreds of megabytes of accurate library code and compiled binaries in seconds.
What was inside the export
Most of the material sat under three directories β /home/hatch, /opt/hatch and /opt/hatch-image. Hatch is Meta's internal name for Muse, and it runs throughout the exported files.
James counted roughly 68 skill directories, each generally pairing a SKILL.md instruction file with a command-line tool, spanning Google Workspace, Outlook, travel, shopping and home devices. An agents directory held 113 subagent records, and about 20 Markdown files documented browser use, connectors, payments and credential handling.
Two configuration files named skill-scopes.conf and bin-scopes.conf listed connectors Meta has not shipped, among them Slack, Dropbox, Canva, Klaviyo and Polymarket. Separately, a document called home_link.md described an experimental integration using ESP32-C5 hardware over Wi-Fi and Bluetooth LE, alongside guides for Brother printers and Lutron bridges β pointing to work on letting the agent reach devices on a home network.
How Muse remembers what you tell it
The export also showed that Muse keeps memory in plain Markdown rather than in model weights. A short MEMORY.md holds curated facts and preferences, dated files carry the day-to-day detail, and Postgres makes them searchable β storing text chunks, 384-dimensional embeddings and claim records that track evidence, confidence and status.
A nightly job that James calls a "dream" reviews recent conversations and writes standing guidance for later sessions.
That design is a deliberate bet. Keeping personalisation in readable files rather than in fine-tuned weights makes a deletion request something a system can actually execute and audit. It also means the most sensitive thing in the environment is a text file, which is exactly the material that left it.
Why Meta says this is not a breach
Meta's launch announcement for Muse describes a dedicated Secure VM for each user, a separate Sentinel agent that must approve anything leaving for the internet, and credential storage the agent itself cannot read.
Roberts leaned on that design, telling The Verge:
Just like with the laptop in front of you, of course you can see the files.
David Singleton, also of Superintelligence Labs, framed Muse as a "free computer in the cloud." James's own concern was narrower: that runtime files and sensitive material could leave the environment through an ordinary conversation and a connected export destination. He probed the container boundary lightly, reported that it held, and did not demonstrate an escape.
What changes for Muse users
The Verge replicated the export itself, receiving "safe" copies stripped of SSH keys after Muse had initially refused on security grounds. That inconsistency, rather than the file listing, is the awkward part: the agent's judgment about what it should hand over moved with the prompt.
A refusal that flattery can reverse is not a boundary, and that distinction matters more as agents gain connectors to inboxes and payment rails. Meta's own architecture implicitly agrees: the Sentinel layer exists precisely because the model's judgment is not treated as the control point. The unresolved question is which of the two β model or gatekeeper β users think they are relying on when they grant an agent access.
Roberts said Meta is continuing to update the product and that users may see changes in how much information is available about their virtual machine. A Confidential VM tier, encrypted with a key only the user holds, is due later this year. It lands after a week in which a separate Muse setting was shown to give attackers a foothold β a flaw Meta did patch.
FAQ
Did anyone access other users' data?
No. Both developers exported the environment assigned to their own session, and Meta says doing so grants no privileged access to its infrastructure or to other people's data. James also said he probed the container boundary, found that it appeared to hold, and did not demonstrate an escape.
Is this the same as the Muse exploit patched this week?
No. Security researcher Patrick Wardle separately found a way to hijack the agent, redirect transcription processing and reach a user's Muse account, and Meta issued a hotfix for it. Meta closed James's filesystem report as "Not Applicable" instead.
Does the export reveal how Meta's model was built?
No. What surfaced was runtime scaffolding β system files, skill definitions, documentation and memory files β not model weights. Muse runs on Meta's Muse Spark model, and nothing in the reported export describes how that model was trained.
