I Requested Meta’s Muse Filesystem—It Delivered 6.8GB

Date: September 22, 2026 | Author: Peter James | Reading Time: $\approx 6$ minutes Categories: #Security #Agents #Sandboxes

---

📦 The Export Incident

In a surprising turn of events, I prompted Meta’s AI, Muse, to archive every file it had access to and transfer that archive directly to my Google Drive. The resulting payload was substantial:

• Compressed Size: $\approx 2.7$ GB
• Unpacked Size: $\approx 6.8$ GB

The archive appeared to be a complete dump of the Linux root filesystem assigned to my specific session. This included everything from standard Ubuntu system files to internal Meta documentation, integration scripts, application templates, agent logs, and memory stores.

Note on Discrepancies: Muse claimed in the chat that the archive (muse-full-root.zip) was $2.86$ GB. My local records show $2.7$ GB. I have not yet reconciled this difference.

Muse also made an unverified claim that it had achieved a container escape.

---

🚩 What I Reported

I have officially submitted these findings to Meta’s bug bounty program and reached out to several company employees. My primary security concern is that sensitive internal runtime files and proprietary material can be exfiltrated from the environment through a standard conversation and a linked export tool.

Reporting Checklist

• Submit bug bounty report
• Contact Meta employees
• Verify if discovered SSH keys are active
• Determine the extent of potential access provided by keys

---

🛠️ The Runtime: "Hatch"

Throughout the leaked files, Meta refers to Muse by its internal codename: Hatch. The most critical data was concentrated in three primary directories: /home/hatch, /opt/hatch, and /opt/hatch-image.

Filesystem Architecture

Detailed Directory Breakdown

---

🧠 Memory and Intelligence

The way Muse handles its "consciousness" is particularly fascinating. It doesn't just store logs; it manages a complex memory hierarchy:

1. The Memory Bank (memory/bank/): Organizes data into specific experiences and preferences, using citations to link back to original source lines.
2. The Dream Cycle (~/dreams/): A nightly process where the agent reviews recent interactions to write guidance for future sessions.
3. Self-Improvement (workspace/self_improvement/): A dedicated area where the agent runs optimization tasks, leaving "receipts" of its changes.

---

🔌 Skills and Integrations

The /opt/hatch/skills/ directory revealed roughly 68 different capabilities. Each skill typically consists of:

• A SKILL.md file (instructions for the AI).
• A corresponding command-line tool or supporting code.

Notable Integrations

The documentation provided an unusually clear window into the system's capabilities:

• Meta Home Link: An experimental integration utilizing an ESP32-C5 chip with Wi-Fi and Bluetooth LE.
• Connectivity: Guides for Tailscale, WhatsApp, and paired Mac devices.
• General Ops: Documentation on handling credentials, payments, and scheduling.

---

💻 Technical Environment

The environment is a containerized Linux setup. I found the codex binary located at: /opt/hatch-image/bin/codex

Additionally, the system uses a specialized version of bubblewrap for isolation:

# Path to the isolation binary
/opt/hatch-image/bin/codex-resources/bwrap

The runtime-cell directory contained the "blueprint" for the agent's world, including the scripts used to launch the environment via systemd-nspawn and the various startup hooks that initialize the agent's state.

---

Disclaimer: This post describes a security vulnerability reported to the vendor. The author does not encourage the unauthorized accessing of internal systems.