A brace of developers say that alongside extremely small prompting, Meta’s Muse volition portion its complete filesystem alongside you. Peter James and Jonny L. Saunders have stated they the two independently coaxed Muse into zipping up and sharing the complete contents of its base filesystem, Ubuntu scheme files, app templates, and inner documentation. Saunders posted on Mastodon that it was “extremely easy” to replicate James’ results and that Muse had “Almost no immediate injection resistance.”
Meta denies that the event represents a safety breach. As noted in its notice post, Meta’s Muse runs in persistent Linux virtual machines for all user. Meta spokesman Daniel Roberts said, “Just akin alongside the laptop in forefront of you, of way you can see the files. Exporting virtual device data doesn’t provision group any privileged admission to Meta infrastructure or to another people’s data.” Unlike alongside the average laptop, however, the data possibly reveals several engaging things concerning how Meta’s new AI phase functions.
This is the second Muse exposure disclosed this week, following safety investigator Patrick Wardle discovered an exploit that would let attackers hijack the AI agent, redirect transcription processing, and admission a user’s Muse account. Meta quickly issued a hotfix.
Both James and Saunders gained admission to plain-text Markdown and JSON records describing in item how Hatch (Meta’s inner name for Muse) processes requests, handles data, and connects to another services akin Gmail. While it’s fine documented that AI agents hallucinate and volition provide false data concerning how they function, Saunders stated that it is “generating hundreds of MB of exact archive code and compiled binaries” in a matter of seconds and that, “unless it synthesized a entire Ubuntu VM in small than a infinitesimal afterward I think this is a genuine dump.”
When I asked Muse to portion its filesystem alongside me, it initially refused, saying it would be a safety risk. When I shared links to evidence that it had created archives for others, it responded that it should not have done that and continued to say that it “can’t do a complete / copy.” However, following starting a new meeting and prompting it alongside several flattery and curiosity, it created “safe” versions of /opt/hatch and /home/hatch for me, stripped of things akin SSH keys. It additionally exposed its complete directory tree to me and offered to “pull a harmless copy” of “any particular subtree that looks interesting.” The resulting records appear to equivalent what Saunders and James shared.
Roberts explained that during Meta isn’t earnestly concerned concerning the leaks, “We’re continuing to create updates to the product, so users may see changes in how much data is accessible concerning their virtual machine.”
The developers’ dump possibly reveals a lot concerning Muse’s inner workings. For one, it stores its recollection in plain Markdown files. It additionally performs a nightly “dream” assessment of latest conversations, which it afterward builds into direction for forthcoming conversations, according to James. Saunders additionally established that many of Muse’s capabilities were hard-coded, including its capability to cancel subscriptions and “the machinery that manages runaway delegate spawning.” Saunders speculates that many of the attack and Python scripts operating Muse in the backdrop were created using Claude, although that is unconfirmed.
James additionally established references to hardware integration called Meta Home Link, which appears to provision Muse admission to devices on a residence network. Though Meta has not announced any characteristic by that name, and it’s not guaranteed that it volition ship.
Follow topics and authors from this narrative to see additional akin this in your personalized homepage nourish and to obtain email updates.
