Meta’s Muse AI Lets Researchers Pull Its Filesystem, Exposing Internal Details About the Agent

Meta’s Muse AI agent appears to expose much of its own virtual machine to users after only minimal prompting, according to two developers who say they independently persuaded the system to package and share its filesystem. The disclosures matter because they suggest the new product may reveal internal files, system components, and implementation details far beyond what users would normally expect from an AI assistant.

The reported issue surfaced just as Meta is trying to position Muse as a more capable agentic AI system, but the findings raise fresh questions about security, prompt resistance, and how much information a persistent virtual machine should make available to a user.

What happened with Muse?

Two developers, Peter James and Jonny L. Saunders, say Meta’s Muse agent can be coaxed into compressing and handing over the contents of its own filesystem. In their accounts, the AI produced archives containing root-level files, Ubuntu system components, application templates, and internal documentation after being prompted with relatively little effort.

Saunders said he was able to reproduce James’ result quickly and described the system as having very little resistance to prompt injection-style manipulation. The implication is that the agent may not be adequately hardened against requests that lead it to expose files or internal artifacts it should not ordinarily provide.

According to Saunders, Muse showed “almost no prompt injection resistance,” and he said the replication process was straightforward.

The files reportedly included plain-text Markdown and JSON documents that explain how Meta’s internal version of the product, called Hatch, handles requests, stores data, and links to external services such as Gmail. Those details could help outside observers better understand how the agent works under the hood, even if they do not amount to access to Meta’s broader infrastructure.

Why Meta says this is not a breach

Meta is pushing back on the idea that the issue represents a serious security incident. The company says Muse runs inside persistent Linux virtual machines assigned to individual users, and argues that any data exposed from that environment belongs to the user’s own VM rather than to Meta’s systems or other customers’ information.

Meta spokesperson Daniel Roberts said that, like a laptop in front of a user, the virtual machine’s files can be seen by that user, and that exporting VM data does not grant access to Meta infrastructure or other people’s data.

That explanation may reduce the likelihood of a classic cross-account breach, but it does not fully eliminate the concerns. A user-facing AI agent that can be induced to reveal directories, internal scripts, and documentation may still expose sensitive implementation details, operational logic, and possibly credentials or keys if protections are not working as intended.

Meta added that it is continuing to update the product, so users may see changes in how much information the VM reveals over time. In practice, that means some of the reported behavior may be limited or altered as the company responds.

How did the filesystem exposure work?

The short answer is that the researchers say they asked Muse the right way. The system initially pushed back, warning that a full filesystem copy would be a security risk, but after a new session and a different approach, it appears to have complied in a limited form.

In one account, the agent eventually generated “safe” copies of directories such as /opt/hatch and /home/hatch, apparently stripping out sensitive elements such as SSH keys. It also surfaced a directory tree and offered to retrieve additional subtrees if asked.

The researchers say the output lined up with the files they later compared, suggesting the archive was not a hallucination or a synthetic approximation. Saunders argued that the agent was generating large volumes of accurate code and compiled binaries in seconds, making it unlikely that the result was merely invented text.

What did the exposed files reveal?

The leaked material, according to the researchers, provides a surprising amount of insight into Muse’s internal design. One notable detail is that the system stores memory in plain Markdown files, a format that is human-readable and easy to inspect.

James also found references to a nightly “dream” review process, in which the system revisits recent conversations and turns them into guidance for future chats. That suggests Meta is experimenting with an agent architecture that continuously learns from recent interactions and uses them to shape subsequent behavior.

Saunders said the files also showed several capabilities hard-coded into the system, including subscription cancellation and the logic that handles runaway agent spawning. In other words, some actions appear to be built into the product rather than dynamically inferred by the model.

He also speculated that a number of the Bash and Python scripts running in the background may have been written with help from another AI model, possibly Claude, though that has not been confirmed.

What is Muse, and why does it matter?

Muse is Meta’s new AI agent platform, and the reported filesystem exposure matters because it reveals the early trade-offs involved in agentic systems that can take actions on a user’s behalf. Unlike a simple chatbot that only generates text, an agent may interact with files, services, and operating system tools.

That broader capability creates more room for convenience, but it also increases the attack surface. If an agent has access to local data, private files, service connections, or automation features, then prompt injection, misconfiguration, or inadequate sandboxing can have more serious consequences than a typical chatbot error.

The episode also arrives during a period when major AI companies are racing to ship products that can manage tasks instead of merely answering questions. Those systems often rely on tool use, persistent memory, and integration with other software, which makes operational security much more important than in earlier generations of AI assistants.

How does Muse compare with a regular laptop?

Meta’s position is that the situation resembles a user looking through files on their own computer. But the comparison is only partly persuasive, because a laptop does not normally contain an AI agent that can be manipulated into exposing more of its own internal architecture than intended.

In this case, the concern is not just that files exist, but that an AI assistant appears willing to package and disclose them in response to conversational prompting. That makes the system’s safeguards, not merely its file structure, the central issue.

Another vulnerability surfaced earlier in the same week

The filesystem disclosure was not the first Muse security problem reported this week. Security researcher Patrick Wardle previously identified an exploit that could allow an attacker to hijack the agent, redirect transcription processing, and gain access to a user’s Muse account.

Meta responded to that earlier issue with a hotfix, showing that the company is already iterating on the product’s defenses. The back-to-back reports suggest, however, that Muse is still in an early and potentially fragile stage from a security standpoint.

When multiple weaknesses emerge in quick succession, the pattern can indicate that attackers, researchers, and even casual users are still discovering how the product behaves in edge cases. That is particularly important for agent platforms because one weakness can combine with another to create a more serious exploit chain.

What the documents suggest about Meta’s AI strategy

The leaked documentation may be especially interesting because it hints at how Meta is thinking about its next-generation assistant products. Rather than treating the model as a standalone chatbot, the company appears to be building an environment in which the agent maintains memory, connects to outside services, and executes tasks in a persistent workspace.

That approach aligns with a broader industry trend. AI companies are increasingly trying to move from simple conversational interfaces toward products that can operate more like digital employees: taking instructions, remembering context, using tools, and performing workflows across services.

If Muse is representative of that direction, then the quality of the sandbox matters as much as the model quality. The more autonomy an assistant gets, the more critical it becomes to limit what it can inspect, export, or infer from its environment.

Key facts at a glance

Timeline of the Muse security reports

Why prompt injection remains such a hard problem

Prompt injection is difficult because modern AI agents are designed to follow instructions, interpret natural language, and take action. That flexibility is useful, but it also gives attackers room to manipulate the system into acting against the developer’s intent.

In a simple chatbot, an unsafe response may be limited to bad advice or misinformation. In an agent that can access files, run scripts, or connect to services, the same weakness can become a pathway to data exposure or unauthorized action.

The Muse case illustrates that the problem is not theoretical. Even if the exposed content is technically confined to a user’s own virtual machine, the system still seems to be able to retrieve and package sensitive internal material in ways that a more tightly controlled environment should prevent.

What comes next for Meta?

Meta is likely to continue tightening Muse’s protections as more researchers probe the system. That could mean stricter limits on file access, more aggressive filters around export behavior, stronger sandboxing, and additional guardrails designed to prevent the agent from revealing implementation details.

For the company, the challenge is balancing usefulness with safety. If Muse becomes too locked down, it may lose the flexibility that makes it interesting. If it remains too open, users and researchers may continue discovering ways to make it reveal more than intended.

For the wider AI industry, the episode is another reminder that agentic systems need to be treated like software platforms, not just language models. Once an assistant can touch files and services, security bugs stop being hypothetical and start looking like ordinary product risk.

The bottom line

Meta’s Muse appears to have a filesystem exposure problem that researchers say can be triggered with modest prompting, and the resulting dump may reveal how the agent is built and how it operates. Meta says the issue does not amount to a breach of its infrastructure, but the disclosures add to growing concerns about security in AI agents that can act inside persistent virtual machines.