Muse AI Leaks Full Filesystem With Simple Prompt — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Peter James and Jonny L. Saunders independently coaxed Meta's Muse into zipping and sharing its full root filesystem, exposing Ubuntu system files, app templates, and internal docs; Saunders called replication "extremely easy" and said the agent has "almost no prompt injection resistance."
- Meta spokesperson Daniel Roberts dismissed the incident as not a security breach, noting Muse runs in persistent Linux VMs per user—"of course you can see the files"—and that exporting VM data grants no privileged access to Meta infrastructure or other users' data.
- The dump revealed plain-text Markdown and JSON files documenting how Hatch (Muse's internal name) processes requests, handles data, and connects to services like Gmail, alongside evidence Muse stores memory in plain Markdown and runs nightly "dream" reviews of recent conversations to guide future ones.
- This is the second Muse vulnerability disclosed this week, following security researcher Patrick Wardle's exploit for hijacking the agent, redirecting transcription processing, and accessing user accounts; Meta issued a hotfix for that flaw.
- Saunders found many Muse capabilities are hard-coded, including subscription cancellation and "the machinery that manages runaway agent spawning," and speculated the bash and Python scripts were built using Claude, though that remains unconfirmed.
- James uncovered references to an unannounced "Meta Home Link" hardware integration that would give Muse access to devices on a home network—a feature Meta has not publicly announced or committed to shipping.
Why it matters: Meta has launched Muse amid an aggressive push to deploy AI agents, yet within one week two separate researchers demonstrated trivial extraction of internal system files and account hijacking, and the leaks surfaced unreleased features like Meta Home Link—meaning Meta is shipping an agent platform whose internals, architecture, and roadmap are publicly readable with a simple prompt.
Ask SkimNews
