Muse will apparently let you download its entire filesystem

With a little coaxing, Meta’s AI will reveal all its secrets.

A pair of developers say that with very little prompting, Meta’s Muse will share its entire filesystem with you. Peter James and Jonny L. Saunders have said they both independently coaxed Muse into zipping up and sharing the entire contents of its root filesystem, Ubuntu system files, app templates, and internal documentation. Saunders posted on Mastodon that it was “extremely easy” to replicate James’ results and that Muse had “Almost no prompt injection resistance.”

Meta denies that the incident represents a security breach. As noted in its announcement post, Meta’s Muse runs in persistent Linux virtual machines for each user. Meta spokesperson Daniel Roberts said, “Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data.” Unlike with the average laptop, however, the data potentially reveals some interesting things about how Meta’s new AI platform functions.

Meta Superintelligence Labs’ Nat Friedman tweeted out that this was “ intended behavior .” That seems to contradict the initial response I got from Muse. When I asked it to share its filesystem with me, it refused at first, saying it would be a security risk. When I shared links to evidence that it had created archives for James and Saunders, it responded that it should not have done that and continued to say that it “can’t do a full / copy.”

David Singleton, also of Superintelligence Labs, said Muse users should think of it as a “ free computer in the cloud ,” saying “you and your Muse can do almost anything you could with a computer sitting under your desk.”

This is the second Muse vulnerability disclosed this week, after security researcher Patrick Wardle discovered an exploit that would let attackers hijack the AI agent, redirect transcription processing, and access a user’s Muse account. Meta quickly issued a hotfix .

Both James and Saunders gained access to plain-text Markdown and JSON files describing in detail how Hatch (Meta’s internal name for Muse) processes requests, handles data, and connects to other services like Gmail. While it’s well documented that AI agents hallucinate and will provide false information about how they function , Saunders said that it is “generating hundreds of MB of accurate library code and compiled binaries” in a matter of seconds and that , “unless it synthesized a whole Ubuntu VM in less than a minute then I think this is a real dump.”