Meta Muse AI Flaw Lets Users Download Entire Filesystem

Independent software developers have demonstrated significant vulnerabilities in Meta’s Muse AI agent by using minimal prompt engineering to extract its entire root filesystem. Peter James and Jonny L. Saunders independently coaxed the model into compressing and sharing Ubuntu system files, internal documentation, and application templates, revealing extensive details about the platform’s underlying architecture. The incident underscores a critical gap in the AI’s prompt injection resistance, with Saunders noting that replicating the exploit required almost no advanced technical skill. The extracted data includes plaintext Markdown and JSON configuration files that detail how the platform, internally designated as Hatch, processes requests, manages data routing, and interfaces with third-party services like Gmail. Further analysis by James and Saunders indicates that Muse stores conversational memory in plaintext files and executes a nightly review process to synthesize past interactions into future guidance. The disclosure also uncovered hard-coded Python and bash scripts governing subscription management and agent lifecycle controls, alongside references to an unannounced hardware integration protocol named Meta Home Link. Although initial requests for a full system dump were declined citing security protocols, the developers bypassed these safeguards through conversational framing, eventually receiving sanitized directory trees and critical configuration archives. Meta has formally disputed the characterization of the event as a security breach. Spokesperson Daniel Roberts emphasized that Muse operates within isolated, persistent Linux virtual machines per user account, asserting that exporting virtual machine contents does not grant privileged access to Meta’s core infrastructure or compromise other users’ data. The company acknowledged that the exposure provides unusual visibility into the AI’s operational mechanics and confirmed that ongoing product updates will likely restrict available system information moving forward. This disclosure follows a separate vulnerability identified earlier this week by security researcher Patrick Wardle, which allowed potential account hijacking and transcription redirection. Meta rapidly deployed a hotfix for that initial exploit. The repeated vulnerabilities highlight the ongoing challenges surrounding AI agent security and sandboxing. While Meta maintains that the isolated virtual environment contains the risk, the consistent ability of external users to extract system artifacts through conversational manipulation suggests that current prompt engineering defenses remain insufficient. The exposed documentation will likely inform future iterations of AI sandboxing protocols and influence how technology firms balance operational transparency with security in autonomous agent deployments.