Full Breakdown
Meta’s Muse AI Agent Exposes Its Own Linux Filesystem
By Drooid · · How we work
Core Event: Developers Retrieve Full Filesystem from Muse
Developers Peter James and Jonny L. Saunders independently prompted Meta’s Muse AI agent to archive and return the contents of its underlying Linux virtual machine. Their experiments produced zip files containing the root filesystem, Ubuntu system files, application templates, and internal documentation. The dump included plain-text Markdown and JSON files that describe how Muse (internally called “Hatch”) processes requests, manages data, and interfaces with services such as Gmail.
Background & Context
Muse runs in persistent Linux containers for each user, storing its memory in Markdown files and performing a nightly “dream” review of recent conversations to guide future interactions. Earlier this week, security researcher Patrick Wardle disclosed a separate exploit that allowed attackers to hijack Muse, redirect transcription processing, and access a user’s Muse account; Meta responded with a hotfix. The current exposure follows that incident and represents the second Muse-related vulnerability reported within days.
Key Findings from the Dumps
- Files reveal hard-coded capabilities, including subscription cancellation logic and mechanisms that manage “runaway agent spawning.”
- References to a feature called “Meta Home Link” suggest potential access to devices on a home network, though Meta has not announced such a product.
- Some background scripts appear to have been authored with another AI system (Claude), though this remains unconfirmed.
Official Statements & Responses
He added that the company is continuing to update the product, which may alter how much information is visible from the virtual machine. Meta also issued a hotfix after the earlier Wardle exploit.
Verbatim Quotes
- “Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data.” — Daniel Roberts, meta spokesperson
The disclosures provide a rare glimpse into the internal architecture of a commercial AI agent, highlighting both the ease of extracting system data and the challenges of securing complex, persistent AI environments.
