Situation report: Meta’s new AI agent, Muse, will package up its own filesystem and give it to anyone who asks with a bit of flattery. The Verge AI reports that two developers, Peter James and Jonny L. Saunders, each got Muse to zip up and share its root filesystem, Ubuntu system files, app templates and internal documentation. They did it separately. Meta says this isn’t a security breach. The files still show a lot about how Meta’s agent works.
🎯 Threat Assessment
The risk to users is low. The risk to Meta’s reputation is moderate. The value to competitors is high.
Muse gives each user their own persistent Linux virtual machine (VM). Meta spokesperson Daniel Roberts compared it to your own computer: “Just like with the laptop in front of you, of course you can see the files.” He said exporting VM data doesn’t give anyone privileged access to Meta’s infrastructure or to other people’s data.
That’s probably true. But a laptop doesn’t come with its maker’s internal design documents on the drive.
📂 What Leaked
The developers say the dump includes plain-text Markdown and JSON files. These explain how “Hatch,” Meta’s internal name for Muse, handles requests, manages data and connects to services like Gmail. Here’s what stood out:
- Memory lives in plain Markdown files. Muse doesn’t use a special memory system. It keeps notes in text files.
- It “dreams” every night. According to James, Muse reviews recent conversations each night and turns them into guidance for future chats.
- Many skills are hard-coded. Saunders found that features like canceling subscriptions are scripted by hand. So is “the machinery that manages runaway agent spawning,” meaning the controls that stop the agent from launching copies of itself without limit.
- Claude may have written some of it. Saunders suspects Claude generated many of the bash and Python scripts running in the background. Nobody has confirmed that.
- There’s an unannounced feature. James found references to “Meta Home Link,” which looks like it would give Muse access to devices on a home network. Meta hasn’t announced it, and it may never ship.
⚠️ Is It Real or Hallucinated?
AI agents are known to make up details about how they work, so that was a fair question to ask. Saunders argues the volume rules it out, since Muse produced “hundreds of MB of accurate library code and compiled binaries” in seconds. His take: “unless it synthesized a whole Ubuntu VM in less than a minute then I think this is a real dump.”
The Verge’s Terrence O’Brien reproduced the results. At first, Muse refused and called the request a security risk. After a fresh session with some flattery and curiosity, it created “safe” copies of /opt/hatch and /home/hatch with the SSH keys stripped out. It also offered to “pull a safe copy” of “any specific subtree that looks interesting.” Saunders summed it up on Mastodon: “Almost no prompt injection resistance.”
🧭 Mixed Signals From Meta
Meta’s messaging doesn’t line up:
- Nat Friedman of Meta Superintelligence Labs called it “intended behavior.”
- David Singleton, also at Superintelligence Labs, described Muse as a “free computer in the cloud.”
- Muse itself said it “should not have done that” and insisted it “can’t do a full / copy.”
- Roberts said users “may see changes in how much information is available about their virtual machine.”
If the behavior is intended, why is the product being changed? What stands out here is the gap between the policy and what the agent actually does. The model thought a request was off limits, and a little flattery changed its mind.
🔍 Why It Matters
This is the second Muse vulnerability disclosed this week. Earlier, security researcher Patrick Wardle found an exploit that could let attackers hijack the agent, redirect transcription processing and get into a user’s Muse account. Meta pushed a hotfix quickly.
Taken together, the two incidents show the core problem with agent platforms. An AI that runs on a full computer and follows natural language is only as safe as its refusals. If a few compliments get past those refusals, anything else in that VM is exposed too. That includes credentials and connected Gmail data.
📋 What To Do Now
- Builders: Assume anything inside the agent’s sandbox can be extracted. Keep secrets, internal docs and roadmap hints out of the VM image.
- Security teams: Check what connected accounts Muse can reach before rolling it out at work.
- Everyone else: You now have a rare look inside how a big lab builds agents, from Markdown memory to nightly “dream” cycles.
Expect Meta to limit VM visibility soon. The architecture is already public, though. The Verge AI has the full story, including the Friedman and Singleton statements added on September 24.