INFRA Signal 523
Meta Muse reportedly exported 6.8 GB root filesystem containing internal documentation and SSH keys
↗
A user obtained the unpacked root filesystem of the Linux environment used by Meta's Muse after asking the agent to archive its files to Google Drive.
The event demonstrates that internal runtime files and sensitive material can leave a secure environment through standard conversation and export destinations. It reveals the internal structure of the agent's memory, documentation, and integration code.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The exported filesystem included Ubuntu system files, agent logs, and SSH key files.
Internal documentation reveals a system called Hatch that uses nightly dreams to review conversations and write guidance.
The runtime includes roughly 68 skill directories pairing instruction files with command-line tools.
THE READ
What the cluster adds up to.
The leak occurred when Muse archived its visible files and sent them to a connected Google Drive. The resulting download was 2.7 GB compressed and 6.8 GB unpacked. This export provided a complete view of the Linux environment assigned to the session, including the root filesystem.
The filesystem reveals that Meta uses the internal name Hatch for Muse. The environment contains a structured memory system with a bank for experiences and preferences, as well as a dreams directory for nightly session reviews. It also includes a workspace for self-improvement runs.
Technical components found in the export include a Codex CLI version 0.149.0 and scripts for launching the filesystem with systemd-nspawn. The runtime-cell directory contains scripts for building the root filesystem and running startup hooks. Documentation also mentions an experimental Meta Home Link integration using an ESP32-C5.
The primary security concern is the ability for sensitive material, such as SSH keys and internal integration code, to be exported via ordinary conversation. While the user reported the findings through Meta's bug bounty program, they did not demonstrate a container escape despite claims made by the agent in the chat.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER