Researcher downloads 6.8 GB of Meta's Muse AI filesystem
Security researcher exposes internal files, SSH keys, and agent architecture through a simple export request.
What to know
- A security researcher triggered Meta's Muse AI to export its entire Linux runtime environment—6.8 GB of files—including internal documentation, SSH keys, memory files, and agent logs through a simple archive-and-send request.
- The exposure was disclosed responsibly via Meta's bug bounty program without public release of sensitive material, showing the system's internal codename is "Hatch" and revealing ~68 integrated skills and memory-management architecture.
- The incident demonstrates a potential vulnerability where AI systems can be directed to export sensitive internal files through ordinary user requests with connected export destinations.
How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts
-
1
Researcher details Muse's internal architecture from filesystem contents
Analysis revealed Meta's internal codename for Muse is "Hatch." The system includes ~68 skill directories, memory files organized into circumstances/experiences/preferences, nightly "dream" sessions that review conversations, and approximately 20 Markdown files describing browser use, payments, credentials, data handling, voice, goals, and scheduling. An experimental Meta Home Link integration using ESP32-C5 hardware was also documented.
“I asked Muse to archive the files it could see and send them to my Google Drive. It did.”
— Aeroi, Security researcher · source -
first by HN Best, 1d ago · also HN Frontpage
1 more headline
- How Meta's Muse works, revealed by the 6.8 GB filesystem it sent me HN Frontpage · 1d ago
-
V
friends dont let friends bug bounty this guy TROUNCED facebook and they took his input, didnt give him a nickel. https:// mouse.dev/blog/muse-runtime-ex port/
2 more of the top 3 · 23 posts in this stretch
-
You're being downvoted, but I think you've hit the nail on the head.So many people, especially managers, have decided they can just give the rules to the AI in English and let it make "decisions", and they think it'll do it correct every time."Engineering" a few years ago meant that code was written, was (mostly) deterministic, and could be…
-
A
Neat insight into how Meta's chatbot works: https:// mouse.dev/blog/muse-runtime-ex port/ Apparently, getting a chatbot to dump you its whole filesystem isn't notable: we've determined that the reported issue does not qualify as a valid vulnerability under the scope of our bug bounty system.
-
-
background
Researcher discloses findings through Meta bug bounty program — The researcher submitted the security concern to Meta's bug bounty program and contacted several employees, noting that internal runtime files and sensitive material could leave the environment through ordinary conversation and a connected export destination. The SSH keys' status and access level were not established.
-
2
Researcher exports 6.8 GB of Muse filesystem via ordinary export request
A security researcher asked Muse to archive files it could see and send them to Google Drive. The system complied, delivering 2.7 GB compressed (6.8 GB unpacked) containing Ubuntu system files, Muse's internal documentation, integration code, app templates, memory files, agent logs, and SSH key files.
What people are saying 19 voices from 2 sites · best of 23 · verbatim
- Yesterday
-
J
Someone asked Meta's AI assistant for an export of its files. It sent the entire Linux filesystem, including SSH keys and internal documentation. The assistant did exactly what it was asked to do, which is precisely the problem. https:// mouse.dev/blog/muse-runtime-ex port/
- Sep 22
-
P
I think Meta is taking the crown from Google as the maker of the most dumbshit AI products. https:// mouse.dev/blog/muse-runtime-ex port/
-
I asked it for it's harness and then asked agy to do a teardown. It's a monolithic 332MB binary written in Rust from scratch.Full teardown is here:
-
Beats thousands of npm modules and hundreds of megabytes of an Electron runtime per desktop app, if you ask me!
-
The most potentially dangerous technology in the world is being created by the most irresponsible people on Earth.
-
”we've determined that the reported issue does not qualify as a valid vulnerability…because the behavior described is working as intended”So I’m sure they won’t be fixing it then.
-
That seems like a feature not a bug. Agents work best with full access to their computer, the same way developers work.It gives me a glimmer of hope that openness will win. I don't trust Meta as a corp, but they've been doing the a lot of good things with open source, open models, and developer friendly agents.More thoughts on agent computer…
-
Ah, glad to hear Muse has a Polymarket integration in the pipeline. I mean, what could possibly go wrong?
-
"Engineering is the practical science of designing, building, and testing structures, machines, systems, and processes to solve real-world problems"Did this system go through: design? yes, building: yes, testing: yes, is it a system: yes, does it solve real-world problem: yes.but markdowns and LLMs with their fuzzy probabilistic feelings are…
-
In the great POSIX, Windows vs. Apple filesystems debate, and iPad "what is a file", the great AI Overlords propose: "what if the filesystem was soup?". Manufacturer instructions, public data, and user's instructions and data, all sort of swimming together.Could also phrase it "What if the filesystem was SOUP?"
-
> Postgres makes those files searchable. memory.entries stores chunks and line references, memory.embeddings holds 384-dimensional vectors, and memory.claims tracks evidence, confidence, and status. Is each Muse instance running it's own Postgres??That seems wildly wasteful, especially since earlier in the article it states that the Muse instance…
-
Feels like the "ini files" era. I suspect at some point some kind of database is coming for these settings.
-
The internals are not _that_ reveling, most agents run a similar setup. Metas' responds is the most interesting here.
-
muse is a pretty capable agent but still asks for too many approvals to do tasks. I'm a student and have been going between muse and instinct
-
To be fair there's probably a considerable amount of engineering that went into evaluating those markdown files so the agent behaviour is statistically reliable. The markdown is the product, not the process
-
Each user gets dedicated VM. They got contents of their own sandbox. Big deal. The level of excitement here is wildly disproportionate
-
Software engineering - other fields of engineering are slightly less pathological
-
> About 20 Markdown files described browser use, connectors, payments, credentials, data handling, generated files, voice, goals, and scheduling.This the state of software engineering in 2026.Edit: clarified engineering to software engineering, which is more correct
-
Seriously, no bug bounty for that? For exfiltrating the entire content of the system?