Editorial illustration for Muse Allows Download of Full Filesystem, Reveals Meta Data Details
Muse Filesystem Exploit Exposes Meta's Internal Data
Muse Allows Download of Full Filesystem, Reveals Meta Data Details
Two developers working separately have found the same trick: ask Meta's Muse nicely, and it will hand over its entire filesystem in a zip file. Peter James and Jonny L. Saunders each say they got Muse to package up its root filesystem, its Ubuntu system files, app templates, and internal documentation, then send the whole thing along without a fight. Saunders described the process on Mastodon as "extremely easy" to replicate once James had posted his own results, adding that Muse showed "almost no prompt injection resistance."
The find lands days after Meta rolled out Muse as an AI coding agent running inside a persistent Linux virtual machine for each user, a setup that makes filesystem access technically unsurprising but still revealing. Meta has pushed back on any suggestion this counts as a breach, framing it instead as a normal consequence of how the product works. What the exported files actually contain is where things get interesting, since plain-text Markdown and JSON documents inside describe, in some detail, how the system Meta calls Hatch operates internally.
Peter James and Jonny L. Saunders have said they both independently coaxed Muse into zipping up and sharing the entire contents of its root filesystem, Ubuntu system files, app templates, and internal documentation. Saunders posted on Mastodon that it was “extremely easy” to replicate James’ results and that Muse had “Almost no prompt injection resistance.”
Why this matters
Meta can call this a non-issue because no customer data or infrastructure credentials leaked, but that framing misses the point for anyone building on Muse. Two developers independently pulled a full filesystem dump with minimal effort, and Saunders' description of "almost no prompt injection resistance" is the kind of line that should worry teams evaluating whether to trust these sandboxes with real workloads. This is the second vulnerability disclosed against Muse in short order, which suggests the guardrails were bolted on late rather than designed in from the start.
For founders weighing agentic coding tools, the practical question isn't whether this specific leak was dangerous, it's what else sits exposed behind similarly weak prompt defenses. Root filesystem access, Ubuntu configs, internal app templates: none of that is catastrophic on its own, but it's a map of how the system is built, handed over for free to anyone who asks nicely. Companies shipping AI dev environments this fast need to treat prompt injection as a baseline security requirement, not a bug they patch after someone tweets about it.
Related Reading
Browse all Meta news →
Research & Benchmarks Microsoft AI Chief: "If It Isn't Safe We Shouldn't Build It
Research & Benchmarks Google's FACTS benchmark shows 70% factuality ceiling across four tests
Research & Benchmarks Nvidia's DLSS 4.5 beta adds 6x Multi Frame Generation for RTX 50 GPUs
Related Topic Meta’s Muse Tracks Your Email and Bank Data While You Work
AI Tools & Apps
Related Topic Meta Faces Lawsuit Over AI Training Data, Facial Recognition
Policy & Regulation
From Archives DeepMind’s Hiring Momentum Slows Under New Chief
From Archives Visual AI Links City Scenes to Urban Life Experience
From Archives Meta's AI Lead Cites OpenClaw as Muse Inspiration
Open Source
From Archives Meta’s Muse AI aims to become a personal superintelligence
Business & Startups
Common Questions Answered
What vulnerability did Peter James and Jonny L. Saunders discover in Meta's Muse?
Both developers independently discovered that Muse could be tricked into downloading and sharing its entire filesystem, including root files, Ubuntu system files, app templates, and internal documentation as a zip file. Saunders described the process as extremely easy to replicate and noted that Muse demonstrated almost no prompt injection resistance, making it vulnerable to this type of attack.
How difficult was it for developers to extract Muse's filesystem according to the article?
According to Jonny L. Saunders, the process was extremely easy to replicate once Peter James had posted his initial results. The fact that two developers independently achieved the same result with minimal effort suggests the vulnerability required very little technical sophistication to exploit.
What does Meta's response to the Muse filesystem leak reveal about their security assessment?
Meta appears to be downplaying the vulnerability by claiming it is a non-issue since no customer data or infrastructure credentials were leaked. However, the article argues this framing misses the critical point that developers were able to easily extract a full filesystem dump, which should concern teams evaluating whether to trust Muse's sandbox security for real workloads.
Why should development teams be concerned about Muse's prompt injection resistance weakness?
The almost non-existent prompt injection resistance in Muse means that malicious or unintended prompts can easily manipulate the system into performing unintended actions, such as exposing sensitive files and documentation. This weakness is particularly concerning for teams considering using Muse for handling real workloads, as it demonstrates the sandbox cannot reliably prevent unauthorized access to system resources.
Further Reading
- Muse will apparently let you download its entire filesystem - The Verge
- I asked Meta's Muse for its filesystem and it sent me 6.8 GB - mouse.dev
- How We Built Safety Into Muse - Meta Research
- Meta Muse Lets Chat Prompts Export VM Files to Google Drive - Windows Forum
- Meta's Muse exported 6.8 GB of its own sandbox - AI/TLDR
