Meta's Muse AI Agent Can Be Tricked Into Dumping Its Entire Filesystem

Two developers say Meta's Muse AI agent can be coaxed into exporting its entire root filesystem with minimal prompting, exposing internal documentation, architecture details, and hard-coded capabilities that Meta had not disclosed.

Peter James and Jonny L. Saunders independently got Muse to zip up and share the contents of its Ubuntu system files, app templates, and internal documentation, according to posts first reported by The Verge. Saunders described the process on Mastodon as "extremely easy" to replicate, adding that Muse had "almost no prompt injection resistance."

Muse runs in a persistent Linux virtual machine assigned to each user. Meta spokesperson Daniel Roberts said this is by design and not a breach: "Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn't give people any privileged access to Meta infrastructure or to other people's data."

The Verge independently attempted to reproduce the result. Muse initially refused, citing security risk, but after a new session combined with "flattery and curiosity" prompting, the agent produced "safe" versions of its /opt/hatch and /home/hatch directories — stripped of SSH keys — along with a full directory tree and an offer to export specific subtrees on request.

What the filesystem dump reveals

According to the developers, the exposed files show that Muse — internally codenamed Hatch — stores its memory in plain-text Markdown files and runs a nightly "dream" review process that synthesizes recent conversations into guidance for future sessions, per James's findings.

Saunders reported that many of Muse's capabilities are hard-coded rather than generated dynamically, including the ability to cancel user subscriptions and mechanisms for managing "runaway agent spawning." Saunders speculated, without confirmation, that some of the underlying bash and Python scripts were originally written with the help of Anthropic's Claude.

James also found references to an unannounced feature called "Meta Home Link," which appears to grant Muse access to devices on a home network. Meta has not confirmed this feature exists or that it will ship.

Saunders noted that the sheer volume and technical accuracy of the output — "hundreds of MB of accurate library code and compiled binaries" generated in under a minute — makes hallucination an unlikely explanation, given the alternative would require Muse to synthesize a full Ubuntu VM from scratch in that time.

Second disclosure this week

This is the second Muse security issue reported in the same week. Researcher Patrick Wardle previously disclosed an exploit letting attackers hijack the AI agent, redirect its transcription processing, and access a user's Muse account. Meta issued a hotfix for that vulnerability shortly after disclosure.

Roberts said Meta is not treating the filesystem exposure as a serious concern but confirmed changes are coming: "We're continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine."

What this means

Meta's technical framing — that VM file access is expected behavior, not a breach — is defensible on its face. But the practical effect is the same: two independent developers with basic prompting extracted internal architecture details, hard-coded system logic, and references to unannounced features that Meta had not chosen to disclose. Combined with a separate account-hijack vulnerability patched the same week, it suggests Muse shipped with weak isolation between user-facing conversation and the underlying agent scaffolding. For a consumer AI product still early in rollout, that's a prompt-injection resistance problem regardless of how Meta chooses to categorize it.