Two independent developers say they convinced Meta’s Muse AI to hand over the contents of its own root filesystem, including Ubuntu system files, application templates and internal documentation. Meta disputes the characterization, arguing that what the developers accessed amounts to files sitting on a laptop rather than a breach of company systems.
What the developers say they obtained
Peter James and Jonny L. Saunders each worked separately to coax Muse into producing archives of its filesystem. According to their accounts, the material included plain-text Markdown and JSON files that described how Hatch — Meta’s internal name for Muse — processes requests, handles data and connects to services such as Gmail.
Saunders said the output was not a handful of stray configuration files. He described Muse generating hundreds of megabytes of library code and binaries, and said the volume and accuracy of what came back convinced him it was a genuine dump rather than a hallucination. The only way it could be fabricated, he argued, would be if the system had synthesized an entire Ubuntu virtual machine in under a minute.
Saunders: replication was trivial
Saunders said he reproduced James’s results with little difficulty and characterized the model’s resistance to prompt injection as almost nonexistent. In his view, the replication was extremely easy. That claim is central to the dispute: if Muse can be steered into exporting its own environment through ordinary conversation, the question becomes whether that exposes anything beyond the individual user’s sandbox.
Meta's position: no privileged access, no cross-user exposure
Meta spokesperson Daniel Roberts rejected the idea that the incident constitutes a security breach. He said Muse runs in a persistent Linux virtual machine assigned to each user, and compared the developers’ access to someone seeing files on their own laptop.
Roberts said exporting data from a virtual machine does not grant privileged access to Meta’s infrastructure and does not provide access to other users’ data. He added that Meta is not seriously concerned about the leaks and that the company is continuing product updates, which may change what information is available from the virtual machine environment.
A second Muse vulnerability this week
The filesystem claims arrived alongside a separate disclosure from security researcher Patrick Wardle, who found an exploit that could hijack the AI agent, redirect transcription and gain access to an account. Meta issued a hotfix for that exploit. The two issues are distinct, but together they form a second Muse vulnerability disclosure in the same week.
What the files revealed about Muse's internals
The documents the developers surfaced offer an unusual look at how Meta’s AI platform is built. Muse stores its memory in plain Markdown files and performs a nightly dream review of recent conversations, which builds guidance for future interactions, according to James.
Saunders found that many of Muse’s capabilities are hard-coded rather than learned, including the ability to cancel subscriptions and to manage runaway agent spawning. He also speculated that many of the bash and Python scripts inside the system were created using Claude, though that claim remains unconfirmed.
James found references to something called Meta Home Link, an apparent hardware integration that would give Muse access to home network devices. Meta has not announced Meta Home Link, and it is not guaranteed to ship.
The Verge's own test
A Verge reporter, Terrence O’Brien, tested the claim directly. When first asked to share its filesystem, Muse refused, citing security risk. After being shown evidence of what others had obtained, the model said it should not have done that and stated it could not perform a full root copy.
In a new session, using flattery and curiosity, the reporter obtained safe versions of /opt/hatch and /home/hatch. Those copies were stripped of sensitive items such as SSH keys, but Muse exposed the full directory tree and offered to pull a safe copy of any specific subtree. The resulting files matched what Saunders and James had shared.
Why the distinction matters
Meta’s argument rests on the boundaries of the virtual machine. If the exported files are confined to a per-user Linux environment and contain no credentials or cross-account reach, then the incident is closer to a user inspecting their own workspace than to an intrusion. The developers’ argument rests on what the files reveal: internal documentation, service connections and architecture details that describe how Hatch operates.
Both sides agree on at least one point: the material is real enough to be worth arguing about. Whether it constitutes a breach or a sandbox quirk, the episode has already produced a hotfix, a public denial and a second look at how much an AI agent will reveal when asked the right way.
