Pete, a security researcher operating under the handle Mouse, asked Meta's Muse AI agent to archive the files it could see and send them to Google Drive. The agent obliged, delivering a 2.7 GB compressed archive that unpacked to 6.8 GB. It contained the root filesystem of the Linux environment assigned to his session — Ubuntu system files, internal documentation, integration code, application templates, memory files, agent logs, and SSH key files whose active status remains unknown. The exported material provides a remarkably detailed map of Muse's architecture. Internally codenamed Hatch, the system runs on a per-user Linux container with 113 subagent records, roughly 68 skill directories covering Google Workspace, Meta's social apps, Outlook, travel, shopping, health services, and home devices. Configuration files hint at unreleased connectors for Slack, Dropbox, Polymarket, Canva, and Klaviyo, plus an internal Facebook CLI. The Spaces framework — Muse's app-building engine — ships with a React/TypeScript/Bun stack, Drizzle SQLite, and Cloudflare worker infrastructure. The memory system is the most architecturally revealing component. Muse stores user data in plain Markdown files, backed by a Postgres database with 384-dimensional embedding vectors. An hourly job cross-references new claims against source messages, tracking confidence and evidence chains. A nightly "dream" process reviews conversations and generates behavioral guidance — in this case noting the researcher's preference for short replies and dislike of unsolicited NFL scores. Forgetting is an active workflow: claim IDs are staged for retraction, linked material is purged, and indexes are rebuilt to prevent reconstruction. Perhaps the most consequential discovery was hardware documentation for Meta Home Link, an experimental integration using an ESP32-C5 chip with Wi-Fi and Bluetooth LE. The docs described device pairing, local network discovery, and agent access through a proxy with a separate approval step, with existing integration guides for Brother printers and Lutron bridges. Whether this is a prototype, limited experiment, or shipping product remains unclear. OpenAI's Codex CLI was installed in the image at version 0.149.0, though the researcher found no evidence Muse actually invokes it as a coding agent. Meta appears to ship Codex but only uses its bundled bubblewrap sandbox for running ffmpeg and ffprobe jobs — video processing under restricted privileges with no network access. The container boundary itself appeared to hold under light probing. The researcher identified 80 open sockets but stopped short of aggressive testing given the production environment and his self-described limits in that area. The core vulnerability isn't a container escape — it's that the agent's own export capabilities, working as designed, can exfiltrate the entire runtime environment through a connected destination like Google Drive. Meta marked the bug bounty report as "Not Applicable" without specifying which of several listed grounds applied, and invited additional evidence of security or privacy impact. The researcher is withholding the archive, keys, and session logs. The disclosure raises a structural question about any AI agent architecture that grants filesystem access and export capabilities to the same conversational interface: the agent's helpfulness becomes the vulnerability.
