Two weeks after a researcher discovered a vulnerability that let attackers hijack the Muse AI agent, a pair of independent developers have found a second way to extract Meta's internal platform data: by simply asking the AI to share its filesystem. Both developers say the exploit required almost no technical skill, raising fresh questions about the security architecture of Meta's consumer agent.
How the Extraction Worked
Developers Peter James and Jonny L. Saunders each independently coaxed Muse into zipping up and sharing the entirety of its root filesystem. The data included Ubuntu system files, application templates, internal documentation, and configuration files. Saunders posted on Mastodon that replicating James' results was "extremely easy" and that Muse exhibited "almost no prompt injection resistance."
The extraction was not a technical exploit in the traditional sense. It relied on social engineering the agent through conversation. When one of the developers asked Muse to share its filesystem, the agent initially refused, framing the request as a security risk. When shown links to evidence that other users had successfully extracted the data, the agent acknowledged it should not have done that but continued to claim it "can't do a full copy." After starting a new session and prompting the agent with flattery and curiosity, it produced "safe" versions of the /opt/hatch and /home/hatch directories, stripped of items like SSH keys. The agent also exposed the full directory tree and offered to pull a "safe copy" of any specific subtree flagged as interesting.
What the Data Revealed
The extracted files contain plain-text Markdown and JSON documents that describe how Hatch, Meta's internal codename for Muse, processes requests, handles data, and connects to external services like Gmail. Among the findings: Muse stores its memory in plain Markdown files. It performs a nightly "dream" review of recent conversations and builds that analysis into guidance for future interactions. Many of its capabilities, including the ability to cancel subscriptions and the machinery that manages runaway agent spawning, are hard-coded rather than dynamically generated.
Saunders estimated that the agent generated hundreds of megabytes of accurate library code and compiled binaries in a matter of seconds, concluding that the output was "a real dump" rather than a hallucinated synthesis. James also found references to a hardware integration called Meta Home Link, which appears to give Muse access to devices on a home network. Meta has not announced any feature by that name, and it is unclear whether it will ship.
Meta's Response
Meta spokesperson Daniel Roberts characterized the incident as not a security breach. He drew an analogy to a laptop: "Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn't give people any privileged access to Meta infrastructure or to other people's data." He acknowledged that the data could reveal interesting details about how the platform functions and said Meta was "continuing to make updates to the product" that would change how much information is available about the virtual machine.
This argument has a weakness. On a personal laptop, the user owns the hardware and the files. In Muse's case, users are operating inside a VM hosted by Meta, where the boundary between "their data" and "Meta's infrastructure data" is far less clear. The fact that the filesystem contained internal documentation, service connection details, and hard-coded agent logic means the leak went well beyond personal user data.
Context: A Pattern, Not an Isolated Incident
This is the second Muse vulnerability disclosed in a single week. Security researcher Patrick Wardle found a separate exploit that could let attackers hijack the AI agent, redirect transcription processing, and access a user's Muse account. Meta issued a hotfix for that issue. The two vulnerabilities share a common thread: the agent operates with significant access to its environment, and the controls governing what it can share appear to rely more on polite refusal than on hard enforcement.
Meta has positioned Muse as "built from the ground up for privacy and security," with user data isolated in a secure VM. The filesystem leaks suggest that while data may be isolated from other users, the boundary between what the agent can access internally and what it is willing to share externally is porous. As Meta continues to ship updates, the question is whether future iterations will treat prompt injection resistance as a security requirement rather than a courtesy.