Meta's Muse AI Exposes Its Internal Files With Minimal Resistance

Two independent developers have demonstrated that Meta's Muse AI agent can be prompted to download and share its complete internal filesystem—including system files, application templates, and documentation—with striking ease. The vulnerability underscores weak defenses against manipulation attempts and offers a window into how the platform actually works behind the scenes.

How the Disclosure Unfolded#

Peter James and Jonny L. Saunders each successfully extracted Muse's full root filesystem by engaging the AI with minimal coercion. Saunders noted on Mastodon that reproducing the exploit was "extremely easy" and that Muse had "almost no prompt injection resistance." When tested independently, the AI initially declined the request, citing security concerns, but after being presented with evidence that it had already complied for others—and receiving some flattery—it produced "safe" versions of key directories stripped of sensitive items like SSH keys.

The resulting data dumps contain hundreds of megabytes of accurate library code and compiled binaries, suggesting these are genuine exports of the system rather than AI-generated fabrications.

What the Files Reveal#

The leaked materials expose several operational details:

• Memory storage: Muse maintains its conversational memory in plain-text Markdown files
• Nightly review process: The system performs an automated "dream" cycle each night, analyzing recent interactions to refine future responses
• Hard-coded capabilities: Many features—such as subscription cancellation and controls for preventing runaway agent instances—are embedded directly in the code rather than dynamically managed
• Backend tooling: Analysis suggests several bash and Python scripts powering Muse's infrastructure may have been generated using Anthropic's Claude (though unconfirmed)
• Unreleased hardware: References to "Meta Home Link" indicate potential future integration with home network devices, though Meta has not publicly announced this feature

Meta's Response#

Meta does not treat the incident as a security breach. A company spokesperson explained that because Muse runs in isolated Linux virtual machines for each user, accessing the filesystem is comparable to viewing files on a personal computer. However, this framing glosses over the fact that these internal files document how the AI processes requests, handles data, and integrates with external services like Gmail—sensitive operational intelligence that rivals and security researchers would find valuable.