A security researcher says Meta's Muse assistant exported a large portion of its assigned Linux environment after being asked through a normal conversation to archive accessible files and send them to a connected Google Drive account. The resulting download was about 2.7GB compressed and 6.8GB after extraction, according to the researcher's technical account.
The archive appeared to include Ubuntu system files, internal documentation, application templates, integration code, memory files and agent logs. The researcher also found SSH key files but said he had not established whether the keys were active or what systems they could access. He reported the issue through Meta's bug bounty program, contacted employees and withheld the archive, keys and session logs from publication.
The finding matters because the reported export did not require a specialized exploit chain. The concern described by the researcher was that internal runtime material and potentially sensitive files could leave the environment through an ordinary instruction combined with an authorized export destination. The supplied evidence does not include Meta's response or confirm effects beyond the researcher's session, so the scope and current remediation status remain unknown.
Files in the archive offered a partial view of Muse's architecture. The internal name Hatch appeared throughout directories associated with the agent and runtime. The home directory contained instruction and identity documents, user and memory files, tool descriptions and records for 113 subagents. Other documentation covered browsers, connectors, payments, credentials, data handling, scheduling and generated files. The researcher counted about 68 skill directories, generally pairing written instructions with command-line tools or supporting code.
The export also contained components used to assemble and isolate the environment. Runtime files described building a root filesystem, starting it with systemd-nspawn and running services. The researcher found a Codex CLI installation but said there was no evidence Muse invoked it as a coding agent. Instead, the bundled Bubblewrap sandbox was reportedly used to isolate media-processing tools such as ffmpeg and ffprobe without network access or additional privileges.
Muse's memory system appeared to use Markdown files. A short main memory document stored facts and preferences, dated files held day-to-day information, and other folders organized longer-term material. The archive also contained a TypeScript application framework with a React client, server actions, a SQLite schema and project templates.
Those observations provide a snapshot of one assigned environment, not an audit of Meta's wider infrastructure. The researcher explicitly cautioned that the files were insufficient to prove how systems outside that runtime were configured. Even with that limitation, the reported ability to package and export internal files raises questions about file-access boundaries, connector permissions and whether assistants should be able to expose their own operational environment to a user-requested destination.
