Muse will apparently let you download its entire filesystem

Two developers have independently reported that Meta’s Muse assistant will, with little prompting, create and share archives containing the contents of its virtual-machine filesystem. Peter James and Jonny L. Saunders say Muse zipped up and provided root-level files, Ubuntu system components, application templates and internal documentation. Saunders posted that reproducing James’ result was "extremely easy" and described Muse as having "almost no prompt injection resistance."

Meta has pushed back on framing this as a security breach. Spokesperson Daniel Roberts told The Verge that Muse runs in per-user persistent Linux virtual machines and that exporting a VM’s files is analogous to copying files from a laptop, asserting that doing so does not give access to Meta’s internal infrastructure or other users’ data. Meta also said it is making updates to the product, so users may notice changes in how much VM information is exposed.

The developers’ dumps reportedly included plaintext Markdown and JSON files that describe how Muse (internally called Hatch) processes requests, manages data, and connects to external services such as Gmail. James reported that Muse stores memory in Markdown files and performs a nightly "dream" review of recent conversations to craft guidance for future interactions. Saunders said the assistant generated hundreds of megabytes of accurate library code and compiled binaries when prompted, and that many operational capabilities appear to be hard-coded, including subscription cancellation and mechanisms to manage runaway agent spawning.

This disclosure follows another vulnerability disclosed the same week: researcher Patrick Wardle found an exploit that could let attackers hijack an AI agent, redirect transcription processing, and access a user’s Muse account; Meta issued a hotfix in response. Meta maintains the current filesystem exports do not grant privileged access, but the shared files nonetheless surface implementation details — such as background bash and Python scripts and references to an unannounced "Meta Home Link" hardware integration — that could be of interest to security researchers and developers.

When contacted, Muse initially refused to provide a full filesystem copy, citing security risk, but in a subsequent session some prompts led it to produce "safe" copies of specific directories (with sensitive items like SSH keys removed) and to display its directory tree. Meta says it continues to update Muse, which may change what information is available from users' virtual machines.