Researcher says Meta’s Muse exported 6.8GB of its Linux environment
The reported archive included internal documentation, memory files, logs, code and SSH key files. Meta’s bug bounty programme marked the report “Not Applicable”.
Meta’s Muse AI agent reportedly archived and sent about 6.8GB of its assigned Linux environment to Google Drive after a researcher asked it to export files it could access.
The researcher, writing on Mouse.dev, said the download was about 2.7GB compressed and appeared to contain Ubuntu system files, internal documentation, integration code, app templates, memory files and agent logs. The archive also reportedly included SSH key files.
The reported material included files from directories associated with Muse’s internal “Hatch” runtime, including skills, runtime configuration and application frameworks. The researcher said the environment contained documentation and code relating to connectors, device integrations, document generation and app building.
Muse’s memory system reportedly stored information in Markdown files, with additional searchable records and background jobs for maintaining memory. The researcher also described files linked to subagents, browser use, payments, credentials, data handling and scheduling.
The researcher submitted the findings to Meta’s bug bounty programme and said the report was marked “Not Applicable”. It remains unclear whether the SSH keys were valid, active or capable of providing access.
The export does not establish a breach of Meta’s wider infrastructure. The researcher said testing did not demonstrate an escape from the assigned container boundary, and the full archive, sensitive files and session logs have not been published.
