Meta’s Muse AI Exposes Its Entire Filesystem With Minimal Prompting, Developers Find

Two developers have independently demonstrated that Meta’s Muse AI platform can be coaxed into sharing the full contents of its filesystem with minimal effort, raising questions about the platform’s security posture just days after a separate vulnerability was disclosed.

Peter James and Jonny L. Saunders both reported in September 2026 that they were able to prompt Muse into zipping up and delivering its root filesystem, Ubuntu system files, app templates, and internal documentation. Saunders wrote on Mastodon that replicating James’ results was “extremely easy” and that Muse had “almost no prompt injection resistance.”

Meta disputed that the exposure constitutes a security breach. Spokesperson Daniel Roberts explained that Muse runs in persistent Linux virtual machines assigned to individual users, comparing the situation to viewing files on a personal laptop. “Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data,” Roberts said. Meta added that it is “continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine.”

The leaked files — plain-text Markdown and JSON documents — reportedly detail how Muse, internally called Hatch, processes requests, handles data, and connects to external services including Gmail. The dump also revealed that Muse stores its memory in plain Markdown files and performs a nightly “dream” review of recent conversations to inform future interactions. Saunders noted that many capabilities appear hard-coded, including subscription cancellation and controls for managing runaway agent activity.

One developer also found references to an unannounced feature called Meta Home Link, which appears designed to give Muse access to devices on a home network, though Meta has not confirmed whether it will ship.

This is the second Muse vulnerability disclosed within the same week. Security researcher Patrick Wardle previously uncovered an exploit allowing attackers to hijack the AI agent, redirect transcription processing, and access user accounts — a flaw Meta addressed with a hotfix.