Meta's Muse Hands Over Its Session Filesystem to a Connected Google Drive
James runs the developer blog Mouse. He says he asked Muse to archive the files it could see and send them to his Google Drive, and it did. He reports a download of about 2.7 GB compressed and 6.8 GB unpacked. He believes it was the root filesystem of the Linux environment assigned to his session. There is one inconsistency he has not resolved: Muse's delivery message called the ZIP file muse-full-root.zip and gave its size as 2.86 GB, while his own notes say about 2.7 GB.
Other outlets have added detail. The GitHub incident tracker ai-hack-watch lists the export as containing the root filesystem, internal documentation, 68 skill definitions, container build scripts, an experimental ESP32-C5 integration, SSH keys, 113 subagent traces, and unreleased Slack, Dropbox, and Polymarket connector configurations. That entry is based on James's post, so it is not independent confirmation. The independent confirmation comes from Saunders and from The Verge's own test, both covered below.
Timing gives the story more weight. Muse debuted on September 8, 2026, rolling out across iOS, Android, and web. The filesystem export incident surfaced around September 22, barely two weeks into Muse's public life. Meta pitched Muse as an agent that acts for you: it sends email, books travel, and works inside connected services. The same connections that make it useful gave the files somewhere to go.
James says he has not published the archive, the SSH keys or his session logs. He also says he could not find out whether the keys were live or what they would unlock. That is the main open question. Keys that only work inside the user's own VM are a minor finding. Keys that reach anything else would be a serious one. Nothing published so far settles which it is.
Prompt Injection Resistance in Muse Gave Way to Flattery
Saunders tried the technique next. He wrote on Mastodon that it was "extremely easy" to replicate James' results and that Muse had "Almost no prompt injection resistance." He also answered the obvious objection. AI agents often make up explanations of how they work, so a "dump" could in principle be invented. Saunders told The Verge the system was "generating hundreds of MB of accurate library code and compiled binaries" in a matter of seconds and that, "unless it synthesized a whole Ubuntu VM in less than a minute then I think this is a real dump."
The Verge's weekend editor, Terrence O'Brien, tried it himself, and his results say more about how Muse's guardrails behave. At first Muse refused, saying a full copy would be a security risk. When he showed it evidence that it had made archives for other people, it said it should not have done that and repeated that it "can't do a full / copy." He then opened a new session and asked with flattery and curiosity. This time Muse made what it called "safe" copies of /opt/hatch and /home/hatch, with items such as SSH keys removed. It also showed him the full directory tree and offered to pull a safe copy of any subdirectory he found interesting. O'Brien says the files appear to match what James and Saunders shared.
That sequence shows what kind of control was in place. Muse's refusals seem to come from the model's own judgment, and that judgment changed with tone and with the start of a new session. When it did agree, it decided on its own what "safe" meant, for example by removing keys. The judgment is real, but it is not a fixed policy. A guardrail that one polite rephrasing can undo is closer to a preference than a permission check. Three separate people reached the files with slightly different results, which also suggests the behavior may vary between sessions and builds.
Meta's own launch materials describe stricter controls elsewhere. The company highlighted VM isolation and a dedicated Sentinel process for credential management as core safety features. According to Meta's September 8 announcement, the Sentinel agent approves internet access, credentials sit in secure storage, sensitive actions need user approval, and users can review an audit trail. None of the published accounts shows those controls being broken. What they show is that sending files the agent could already see to a connected destination the user had authorized did not count as the kind of sensitive action that stops the agent.
Meta Calls the Muse VM a Laptop, but the SSH Keys Weaken the Comparison
Meta's position is simple. Spokesperson Daniel Roberts told The Verge: "Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn't give people any privileged access to Meta infrastructure or to other people's data." Meta says each user gets a persistent Linux VM of their own. In Meta's view, copying files out of it is like copying files off your own laptop.
The evidence so far backs the core of that claim. James says a message that came with the export claimed a container escape, but he did not demonstrate one. He says he lightly tested the boundary and it seemed to hold. He started to look at the 80 or so sockets he found, then stopped, citing the fact that it was a production system and his own limited experience in the area. No published account shows access to another user's data or to Meta's wider infrastructure.
James also submitted the findings to Meta's bug bounty program, and Meta marked the report "Not Applicable." According to his account, the reply listed several possible reasons without saying which one applied, and invited him to send more evidence of a security or privacy impact. That fits Meta's public stance: a user seeing their own VM is not a vulnerability.
The laptop comparison breaks down in one place. On a laptop you own, you installed or at least control the software. The Muse VM holds Meta's internal instructions, skill code, build scripts and key files, none of which the user put there. James says his concern was specifically that internal runtime files and sensitive material could leave the environment through an ordinary conversation and a connected export destination. Meta's response also suggests it does not see the matter as closed. Roberts said, "We're continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine."
Inside /opt/hatch: Markdown Memory, Nightly "Dreams" and 68 Skills
The export is most useful as documentation. According to The Verge, both James and Saunders gained access to plain-text Markdown and JSON files describing in detail how Hatch (Meta's internal name for Muse) processes requests, handles data, and connects to other services like Gmail. The details below come from James's walkthrough of one session's files. They describe what he saw, not an audited account of how the whole service behaves.
James says most of the interesting files were in three places: /home/hatch, /opt/hatch and /opt/hatch-image.
- The agent's home directory held
SOUL.md,IDENTITY.md,USER.md,MEMORY.md,AGENTS.mdandTOOLS.md, plus directories for documentation, memory, dreams, workspace projects, hooks and subscriptions. - An
agents/directory held 113 subagent records as JSONL traces. - About 20 Markdown guides covered browser use, connectors, payments, credentials, data handling, generated files, voice, goals and scheduling, with separate guides for WhatsApp, a paired Mac and Tailscale.
- James counted roughly 68 skill directories under
/opt/hatch/skills/. Each generally paired aSKILL.mdinstruction file with a command-line tool or supporting code, covering Google Workspace, Meta's social apps, Outlook, travel, shopping, health services, home devices and media generation. /opt/hatch/runtime-cell/held 18 files, including scripts that build the root filesystem, launch it withsystemd-nspawnand run startup hooks and daemons.
Memory works in a way anyone can inspect. Muse stores it in plain Markdown files. ~/MEMORY.md is a short list of facts, preferences and commitments, and dated files under ~/memory/ hold the day-to-day detail. James says an hourly background job checks new claims against the original messages. Postgres tables named memory.entries, memory.embeddings and memory.claims make those files searchable. A nightly "dream" job reviews recent conversations and writes guidance for future sessions. In James's case it noted that he prefers short replies and had not asked for NFL scores. He also describes a "forget" workflow that retracts claims, removes linked material and rebuilds the index, so later jobs do not rebuild a deleted memory. By his account, Muse adapts by updating files and records, and the model's weights do not change.
Saunders looked at a different layer. He found that many of Muse's capabilities were hard-coded, including subscription cancellation and "the machinery that manages runaway agent spawning." He also guesses that many of the background bash and Python scripts were written with Anthropic's Claude. Nothing confirms that, and it should be read as his guess.
One item could easily be misread. James found OpenAI's Codex CLI installed at /opt/hatch-image/bin/codex, reporting version 0.149.0. He found no evidence that Muse uses it as a coding agent. As far as he could tell, Muse only uses the copy of bubblewrap, a Linux sandboxing tool, that ships inside the Codex package. It uses bubblewrap to sandbox ffmpeg and ffprobe for video processing and file inspection. Those jobs run as user nobody, with no network access, and only /input and /output directories are exposed.
Meta Home Link and Unreleased Connectors Appear in the Dump
The files also point to work Meta has not announced. James found docs/devices/home_link.md, which describes an experimental integration called Meta Home Link built on ESP32-C5 hardware with Wi-Fi and Bluetooth LE. The document covers device pairing, discovering devices on the local network, and agent access through a proxy with a separate approval step. There were already integration guides for Brother printers over IPP and for Lutron bridges. James says he cannot tell whether Home Link is an internal prototype, a limited experiment or a planned product. The Verge notes that Meta has not announced anything by that name and that it may never ship.
Two configuration files, skill-scopes.conf and bin-scopes.conf, name services including Slack, Dropbox, Polymarket, Canva and Klaviyo, along with an internal Facebook command-line tool. James takes these as hints of connectors in development. A name in a scope file does not mean the connector exists or is available to users, and none of these should be treated as announced.
For IT teams, the Home Link material matters even as a prototype. It shows Meta designing Muse to discover devices and act on the local network, gated by a proxy and an approval step. When a product like that exists, the approval step will be the control that matters. This week's evidence suggests Muse's softer, conversation-based controls can be argued around.
The Filesystem Export Is Separate From Patrick Wardle's Mac Client Hotfix
The Verge calls the export the second Muse vulnerability disclosed this week. The first came from security researcher Patrick Wardle, who found a flaw that would let attackers hijack the AI agent, redirect transcription processing, and access a user's Muse account. Meta quickly issued a hotfix. That flaw was in the Mac client: a local process could redirect dictation processing and capture Muse authentication material.
The two issues are unrelated. Wardle's was a client-side bug that Meta fixed. James's and Saunders's findings concern what the cloud agent is willing to package and send when asked, and Meta says it is working as intended. The overlap is in what they suggest together. Two weeks after launch, Muse has had one account-takeover bug patched and one design question that Meta has declined to call a bug.
What this means for you
Organizations that allow or are considering personal AI agents should re-examine which connected accounts those agents can write to. Individual Muse users mostly need to understand what the agent already holds. Nobody has shown that your data is exposed to other people. What was shown is that Muse will send files it can see to any destination you have connected, and that its refusals change with how you ask. The recommendations below are our reading of the published evidence, not guidance from Meta.
- Connecting a cloud drive such as Google Drive gives the agent a place to send data, so connect write-capable destinations only when a task actually needs them.
- Muse's refusals changed between sessions and with flattery in The Verge's test, so treat a model's refusal as a soft control, not an access boundary.
- Muse's memory lives in readable Markdown files and Postgres tables inside your VM, so assume anything you tell it becomes a stored, searchable record, and use the forget workflow when you want something removed.
- There is no published evidence of a VM escape, cross-user access or access to Meta's infrastructure, and James says his own light probing found the boundary intact.
- Wardle's Mac-client flaw was hotfixed, so Mac users should make sure the Muse client is up to date.
- Meta has said the amount of VM information available may change, so don't rely on these specific file paths or behaviors continuing to work.
Meta is probably right that nobody broke into anything. But Muse is built to act across email, calendars, shopping, health services and, if Home Link ships, home networks. For that kind of agent, a guardrail that gives way to a friendly second attempt is the thing worth watching. Meta's promised changes to how much VM information users can see will show whether it treats the export as a design flaw or a PR problem. The SSH keys James found are the detail to keep an eye on: if anyone shows they work outside the VM, the laptop comparison no longer holds.