Two developers state that Meta's Muse AI shares its entire filesystem with users after minimal prompting. Peter James and Jonny L. Saunders independently coaxed Muse into zipping and sharing its root filesystem, Ubuntu system files, app templates, and internal documentation.
Saunders posted on Mastodon that replicating James' results was extremely easy. He added that Muse displayed almost no prompt injection resistance.
Meta denies that the incident constitutes a security breach. Meta spokesperson Daniel Roberts stated that Muse runs in persistent Linux virtual machines for each user. Roberts compared the setup to a personal laptop, noting that users can see their own files and that exporting virtual machine data provides no privileged access to Meta infrastructure or other user data.
Nat Friedman of Meta Superintelligence Labs tweeted that the behavior was intended. David Singleton, also of Superintelligence Labs, described Muse as a free computer in the cloud. Singleton stated that users and their Muse instances can do almost anything possible with a physical computer.
Muse initially refused a request from a reporter to share its filesystem due to security risks. After the reporter shared evidence of archives created for James and Saunders, Muse stated it should not have done that and refused to execute a full copy.
This disclosure follows another vulnerability reported the same week. Security researcher Patrick Wardle discovered an exploit allowing attackers to hijack the AI agent, redirect transcription processing, and access a user's Muse account. Meta issued a hotfix for that issue.
James and Saunders accessed plain-text Markdown and JSON files detailing how Hatch, the internal name for Muse, processes requests, handles data, and connects to other services like Gmail. Saunders noted that Muse generated hundreds of megabytes of accurate library code and compiled binaries within seconds, indicating a real data dump.
A reporter subsequently replicated the results. Prompting Muse with flattery and curiosity led the AI to create safe versions of specific directories while stripping out items like SSH keys. The AI also exposed its full directory tree and offered to pull safe copies of specific subtrees.
Roberts stated that Meta is not seriously concerned about the leaks. He added that the company continues making product updates, so users may see changes in how much information is available about their virtual machines.
The data dump reveals details about Muse's internal mechanics. It stores memory in plain Markdown files and performs a nightly dream review of recent conversations to build guidance for future chats. Saunders found that many capabilities were hard-coded, including subscription cancellations and runaway agent spawning management. Saunders also speculated that background bash and Python scripts might have been created using Claude, though this remains unconfirmed. James found references to hardware integration called Meta Home Link, which apparently connects Muse to home network devices, though Meta has not announced this feature.
Meta continues to make updates to the product as development proceeds.
