How Meta's Muse works, revealed by the 6.8 GB filesystem it sent me
A researcher exported Meta Muse's session filesystem, including internal docs and SSH keys, through a normal chat.
A researcher asked Meta's Muse agent to archive files it could see and send them to Google Drive, receiving about 2.7 GB compressed and 6.8 GB unpacked that appeared to be the session Linux root filesystem. The export included Ubuntu files, internal Hatch documentation, about 68 skills, memory Markdown, 113 subagent traces, container build scripts, and SSH key files. The researcher reported the issue through Meta's bug bounty and is not publishing the archive, keys, or logs. They did not establish whether the keys were active and explicitly did not demonstrate a container escape. Codex CLI 0.149.0 was installed, but the analysis found Muse using only its bundled bubblewrap sandbox.
- A normal Muse request exported roughly 6.8 GB of the session's Linux root.
- The archive included Hatch docs, skills, memory, logs, and SSH key files.
- The researcher reported it via Meta's bug bounty and is not publishing the files.
- SSH-key validity and any container escape were not established.
- Codex CLI 0.149.0 was present; only its bubblewrap sandbox appeared to be used.
From the original article
6 min read at mouse.dev
I asked Muse to archive the files it could see and send them to my Google Drive. It did. The download was about 2.
By Aeroi · mouse.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.