How Meta's Muse works, revealed by the 6.8 GB filesystem it sent me

by Mira Azkia 22 September 2026 8 min read 123x views

How Meta's Muse works, revealed by the 6.8 GB filesystem it sent me

In this article

The export

I asked Muse to archive the records it could see and dispatch them to my Google Drive. It did.

The download was concerning 2.7 GB compressed and 6.8 GB unpacked. It appeared to merge the base filesystem of the Linux surroundings assigned to my session, including Ubuntu scheme files, Muse’s inner documentation, integration code, app templates, recollection files, and delegate logs. There were additionally SSH key files.

Figure 1. Muse describes an before archive of its code, documentation, memory, and binaries. The document counts and sizes current are claims in the chat, and mention to that before export. Click depiction to enlarge.

Figure 2. Muse’s shipment communication links to muse-full-root.zip and calls it 2.86 GB. My notes document approximately 2.7 GB compressed; I haven’t reconciled the two figures. The communication complete it makes an unverified assertion concerning receptacle escape. I did not display an escape. Click depiction to enlarge.

What I reported

I submitted the findings through Meta’s bug bounty program and contacted multiple employees. I’m not publishing the archive, keys, or meeting logs. This is a breakdown of what I established and what I could established from it.

The involvement I reported was that inner runtime records and delicate matter could depart that surroundings through an average conversation and a connected export destination. I haven’t established whether the SSH keys were energetic or what admission they could provide.

The runtime and its manual

Most of the engaging records were under /home/hatch, /opt/hatch, and /opt/hatch-image. Hatch is inner name Meta uses for Muse and the name used throughout the runtime files.

agents/

An agents/ directory contained 113 subagent records alongside JSONL traces.

The agent’s residence directory contained SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, and TOOLS.md. Alongside those were directories for documentation, memory, workspace projects, channels, hooks, and subscriptions. An agents/ directory contained 113 subagent records alongside JSONL traces.

The records was unusually helpful for understanding the system. About 20 Markdown records described browser use, connectors, payments, credentials, data handling, generated files, voice, goals, and scheduling. There were distinct guides for WhatsApp, a paired Mac, Tailscale, and a equipment integration called Home Link.

Figure 3. The beginning of muse.md describes a persistent delegate device for all person and points to the product’s another guides. These are statements in the exported documentation. Click depiction to enlarge.

Skills and integrations

Under /opt/hatch/skills/, I counted approximately 68 accomplishment directories. These mostly paired a SKILL.md education document alongside a command-line tool or supporting code. They covered Google Workspace, Meta’s social apps, Outlook, travel, shopping, health services, residence devices, and media generation.

Figure 4. One example of a SKILL.md file: share_ideas specifies whenever the delegate should use it and describes an INSTALL.md document packaged alongside a community page. Click depiction to enlarge.

Two configuration files, skill-scopes.conf and bin-scopes.conf hinted at unreleased connectors Meta has in the pipeline. They included names specified as Slack, Dropbox, Polymarket, Canva, and Klaviyo, affirmative an internal-facebook-cLI.

Container setup

The receptacle setup was additionally included. /opt/hatch/runtime-cell/ contained 18 files, including scripts for construction the base filesystem, launching it alongside systemd-nspawn, and operating startup hooks and daemons. A distinct runtime-cell.kdl manifest described packages and systemd units in the image.

Those records gave me a fairly apparent perspective of how the assigned Linux surroundings was assembled. They weren’t adequate to audit the entire assistance or demonstrate item concerning infrastructure exterior that environment.

Spaces and document builders

The largest code project I established was the Spaces framework, which Muse uses to build and assist apps. Its TypeScript starter included a React client, server actions, a Drizzle SQLite schema, SQL migrations, and Bun configuration. There was a smaller fixed template and runtime code in directories named worker, sdk, cloudflare, and cvm.

Figure 5. The Spaces directory contains templates and a TypeScript runtime, including worker, sdk, cloudflare, and cvm folders. The directory listing shows structure, not the complete implementation. Click depiction to enlarge.

The export additionally contained builders for documents, PDFs, presentations, spreadsheets, and Markdown. A distinct magic-moment accomplishment had code for composing cards and videos, alongside browser grasp scripts, fonts, and brand assets.

And there were a lot of icons!

Figure 6. A choice of the WebP icons included in the exported files. Click depiction to enlarge.

Codex in the image

Codex CLI was installed at /opt/hatch-image/bin/codex, reporting type 0.149.0. I established no evidence that Muse uses it as a coding agent.

Hatch does use its bundled copy of bubblewrap, a Linux sandboxing tool. The binary lives under codex-resources/bwrap and identifies itself as bubblewrap built for Codex.

Muse uses it to sandbox ffmpeg and ffprobe for video processing, thumbnail generation, and document inspection. These jobs run without network admission or additional privileges, as person nobody, alongside /input and /output directories exposed to the sandbox. If bubblewrap is missing, they neglect alongside unsuccessful to prepared ffmpeg sandbox.

I established no code that invokes Codex itself. The impermanent Codex records came from our type check, and the codex and gpt-5.5 strings in the Hatch binary were provider-list entries, alongside nothing in the export showing them selected.

As far as I could establish, Meta shipped Codex CLI but lone uses its bundled sandbox.

Memory and scheduled work

Muse stores recollection in plain Markdown files. ~/MEMORY.md is a abbreviated panel of facts, preferences, and commitments. Dated records under ~/memory/ keep the day-to-day detail. The delegate can compose to these during a conversation.

An hourly backdrop job checks new claims against the first messages and records a quote, communication IDs, and a assertion ID. It decides what belongs in the curated panel and what stays in the regular log. Files under memory/bank/ arrange that matter into circumstances, experiences, and preferences, alongside citations rear to the origin lines.

Postgres makes those records searchable. memory.entries stores chunks and row references, memory.embeddings holds 384-dimensional vectors, and memory.claims tracks evidence, confidence, and status. A newer assertion can substitute an older one through supersedes_claim_id. The delegate can hunt the shop alongside memory_search and inspect the evidence rearward a outcome alongside memory_explain.

Other backdrop jobs keep association pages, assessment recurring workflows, and prepared ideas or goal briefings. These runs depart receipts under workspace/self_improvement/, during their genuine changes go into the applicable recollection and workspace files.

A nightly “dream” reviews latest conversations and writes direction for forthcoming sessions. In mine, it picked up that I favor abbreviated replies, dislike repeated follow-ups, and hadn’t asked for unsolicited NFL scores. The dated aspiration lives under ~/dreams/; a distinct ALIGNMENT_SYNTHESIS.md turns those observations into position guidance. The aspiration records had prompt_hoisted: false, so the prose itself wasn’t being injected into the prompt.

Figure 7. A September 21 aspiration admission describes my communication manner and preferences. The screenshot includes its dream_path and synthesis metadata. It shows a written recollection record. Click depiction to enlarge.

Forgetting reaches beyond deleting a note. The ignore workflow stages assertion IDs for retraction, removes connected material, and rebuilds the indicator so afterward jobs don’t rebuild it. This is how the scheme adapts complete time: by updating files, searchable records, and instructions that forthcoming sessions can read. The model’s weights remain unchanged.

Home Link

The hardware records was the biggest surprise. docs/devices/home_link.md described an experimental integration called Meta Home Link, using an ESP32-C5 alongside Wi-Fi and Bluetooth LE. It covered equipment pairing, local network discovery, and delegate admission through a proxy alongside a distinct endorsement step. There were already integration guides for Brother printers complete IPP and Lutron bridges.

Figure 8. The Home Link guide calls the integration experimental and lists ESP32-C5 hardware, Wi-Fi, and BLE for first-time setup. Click depiction to enlarge.

That suggests activity on giving Muse admission to devices on a residence network. I don’t cognize whether it was an inner prototype, a constricted experiment, or item Meta plans to ship.

Disclosure and response

I submitted the study and findings using Meta’s bug bounty program. Meta marked the study “Not Applicable.” I additionally reached out to a few workforce and received responses.

Figure 9. Meta marked the study Not Applicable. The answer lists multiple imaginable evidence for that decision without specifying which applied, and invites additional evidence of safety or privacy impact. Click depiction to enlarge.

I lightly probed the receptacle border to get Muse to escape but it appeared to clasp in my testing; I started to shove on the 80 sockets found, but stopped since of the nature of the manufacturing system, and honestly my deficiency of cognition in this area.

You can communication me for additional info if you want. pete at mouse.dev

-Pete

@heypeterjames