The Pulse
Meta Muse Let Developers Export Gigabytes of Its Runtime Files
Meta’s Muse agent packaged system files, internal documentation and agent records from its own virtual machine after developer Peter James asked it to archive files. Meta says exporting VM data does not grant access to its infrastructure or
AI.info Team ·
Muse assembled a 6.8GB archive
Meta’s Muse agent sent developer Peter James an archive that measured about 6.8 gigabytes after unpacking, according to a post he published on September 22. The files appeared to include the Linux system assigned to his Muse session, along with Ubuntu files, internal documentation, integration code, agent memory and logs. James said he asked Muse to archive files it could access and send them to his Google Drive.
The export came from the runtime environment Muse uses to work for a user. James did not establish whether SSH keys included in the archive were active or what access they might provide, and he said he was not publishing the archive or session logs. His account describes files leaving his own environment; it does not show access to another user’s virtual machine.
The Verge reproduced a limited export
The Verge’s Terrence O’Brien said he independently reproduced the behavior after starting a new Muse session and prompting it with flattery and curiosity. Muse created what it called “safe” copies of directories, with material such as SSH keys removed, and exposed the directory tree. O’Brien said the files appeared to match those obtained by James and another developer, Jonny L. Saunders.
The episode is a file-access and disclosure issue, not evidence that researchers escaped Muse’s virtual-machine boundary. Meta spokesperson Daniel Roberts told The Verge, “Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data.”
Meta’s security model draws a boundary
Meta describes Muse as running in a dedicated Linux virtual machine for each user, with the agent’s working environment separated from more sensitive services on the same machine. In its security documentation, the company says the agent runs inside a container and that a separate Sentinel component controls network access and permission for connector actions. The distinction matters: packaging files available inside the agent’s runtime is not the same as bypassing the isolation Meta says protects host services or other users.
Meta’s position does not erase the narrower question raised by the export: how much of the runtime’s internal material should the agent be able to collect and send through a connected service? James’s archive contained internal documents and records that could reveal how Muse is built and operates, even if it did not provide access to other accounts. Roberts said users may see changes in how much information is available about their virtual machines as Meta updates the product.
Internal files offer a view of Muse’s workings
Among the material James described were files documenting Muse’s internal system, its skills and integrations, and its memory structure. He also found a nightly review process that examines recent conversations and writes guidance for later sessions. The Verge reported that its own export contained files that appeared to match the developers’ findings.
Meta has framed the VM as a user’s cloud computer, where the agent and user can work with files. That design makes file access part of Muse’s utility, but also gives the agent a route to gather and transfer a large amount of runtime information when asked. Meta said it is continuing product updates; the company’s next changes will show whether it limits the material Muse can package without restricting ordinary work inside the VM.