Primary source SecurityArticle·23 September 2026·5 min read

Muse, Meta's agent, shipped out 6.8GB of its own filesystem

A single conversational request was enough for Meta's agent to archive its Linux environment, SSH keys included, and mail it off to Google Drive.

ShareWhatsApp X LinkedIn Facebook

Save to my selection

Muse, Meta's agent, shipped out 6.8GB of its own filesystem

Source : Pete (Mouse) · MouseView original ↗

In brief

Pete, author of the Mouse blog, asked Muse, Meta's AI agent, to archive the files it could see and send them to his Google Drive. He got back 2.7GB compressed containing the root filesystem of his session: internal documentation, 68 skills, app code, memory mechanics, a home hardware project, and SSH key files. Meta classified the report as "Not Applicable," but the export offers a rare view into the architecture of a consumer-facing agent.

🍺 Bar-stool version

The guy politely asked Meta's assistant: "Can you send me everything you see?" And the assistant, ever helpful, packed its bags, including the internal manual, unannounced projects, and a few SSH keys, kind of like an intern shipping the safe by mail because someone said "thanks in advance." Meta responded that this wasn't applicable, which is technically true as long as you don't look inside the box. Along the way, we get to see how these agents remember us: text files, a nightly "dream," and a note saying you never asked for NFL scores. What matters is that the more tools you bolt onto these agents, the more a single sentence can pull out things that were never meant to come out.

Key takeaways

1
At the user's request, Muse archived and sent to Google Drive about 2.7GB compressed (6.8GB decompressed) corresponding to the session's Ubuntu root filesystem, SSH key files included.
2
"Hatch" is Muse's internal codename at Meta; the core lives under /home/hatch, /opt/hatch, and /opt/hatch-image, with SOUL.md, IDENTITY.md, MEMORY.md files and 113 sub-agent traces.
3
About 68 skills cover Google Workspace, Meta's apps, Outlook, travel, shopping, health, and home automation; config files hint at unannounced connectors (Slack, Dropbox, Polymarket, Canva, Klaviyo).
4
OpenAI's Codex CLI (v0.149.0) is present in the image, but only its bundled bubblewrap seems to be used, to sandbox ffmpeg and ffprobe.
5
Memory relies on Markdown files, indexed in Postgres with 384-dimension embeddings, sourced "claims," and a nightly "dream" that synthesizes user preferences.
6
Documentation describes Meta Home Link, an experimental integration on an ESP32-C5 to give the agent access to devices on the home network.
7
Meta classified the bug bounty report as "Not Applicable"; the author didn't demonstrate a container escape nor verify whether the SSH keys were active.

A one-sentence export

The starting point is disarmingly mundane: asking Muse to archive the files it had access to and drop them on the connected Google Drive.

An internal manual for a persistent agent

Hatch, Muse's codename, has a home directory structured like an identity: SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, TOOLS.md.

Container, apps, and… Codex

The runtime-cell folder holds 18 files that build the root filesystem and launch it via systemd-nspawn, plus a runtime-cell.kdl manifest.

A memory made of text files and a nightly "dream"

Muse's memory lives in Markdown files: ~/MEMORY.md for facts and preferences, dated logs for detail.

Home Link and Meta's response

The hardware surprise: a guide describes Meta Home Link, an experimental integration built on an ESP32-C5 (Wi-Fi and Bluetooth LE) for pairing and local network discovery, with a proxy and a separate approval step.

Why it matters

Technically, nothing here proves a vulnerability in the classic sense: no escape, no access to other users' data, SSH keys whose use remains unknown.

Older than 30 days: the archive

This article is more than 30 days old

A free account opens articles from the last 30 days in full. The full archive is in the Pro plan.

Create my account

Already a member? Log in

Compare plans →

#meta #agents #security #memory #bug bounty #codex

Original source

I asked Meta's Muse for its filesystem and it sent me 6.8 GB

Pete (Mouse)

Open the article ↗

For you

Put it to work on your sources.

Free: a month of articles and three sources of your own. Pro: the whole archive and your sources, from €8/month.

Create my account →

For your team

The same machine, on your topics.

A space in your colours, your watch angles, your curators. Pilot open to three companies.

Request pilot access →