Two developers say Meta’s Muse agent packaged and shared large portions of the Linux filesystem in their individual sessions after simple requests. The Verge reports that Peter James and Jonny L. Saunders independently obtained archives containing system files, application templates, and internal documentation. The Verge’s own test also exposed a directory tree and copies of selected folders after an initial refusal.
Meta says each Muse user has a persistent virtual machine and that seeing files inside it does not grant access to Meta infrastructure or another user’s data. That distinction matters. The reported archive is evidence of visibility into a user’s agent environment, while the article does not establish a cross-user breach.
Internal instructions can still be revealing
The files described by the developers include Markdown and JSON documents about how Muse handles requests and connects to other services. James says the environment stores agent memory in Markdown files and reviews recent conversations overnight. Those details come from files the developers say they obtained; Meta has not publicly confirmed each interpretation of them.
The Verge also describes a separate Muse account hijacking flaw reported earlier this week that Meta says it patched. The filesystem disclosure and that patched flaw should be evaluated separately. One concerns what a user can ask their own agent to export. The other involved an attacker’s ability to redirect processing and reach an account.
