Meta’s Muse AI agent exposed internal files after minimal prompting

Meta’s Muse AI agent, designed to operate within persistent Linux virtual machines for each user, was shown by two developers—Peter James and Jonny L. Saunders—to be vulnerable to prompt injection attacks that allowed it to expose its entire root filesystem. Saunders described the process as “extremely easy” to replicate and noted that Muse had “Almost no prompt injection resistance.” The exposed data included Ubuntu system files, app templates, and internal documentation, as well as plain-text Markdown and JSON files detailing how Muse processes requests, handles data, and connects to external services like Gmail.

Meta spokesperson Daniel Roberts responded that exporting virtual machine data does not provide privileged access to Meta’s infrastructure or other users’ data, comparing the scenario to accessing files on a personal laptop. However, the disclosed files revealed internal details about Muse’s operation, including its use of plain-text Markdown files for memory storage and a nightly “dream” review process that synthesizes recent conversations into guidance for future interactions.

Saunders also found that many of Muse’s capabilities, such as canceling subscriptions and managing runaway agent spawning, were hard-coded into the system. He speculated that some of the underlying bash and Python scripts may have been generated using another AI model, though this remains unconfirmed. Additionally, references to an unreleased feature called Meta Home Link were discovered, which appears to enable Muse to interact with devices on a user’s home network.

This is the second Muse-related vulnerability disclosed in the same week. Earlier, security researcher Patrick Wardle demonstrated an exploit that allowed attackers to hijack the AI agent, redirect transcription processing, and gain access to a user’s Muse account. Meta issued a hotfix in response to Wardle’s findings. Despite these issues, Meta stated it was not seriously concerned about the leaks, though it acknowledged ongoing updates to limit the information available about users’ virtual machines.