I requested Meta’s Muse for its filesystem and it despatched me 6.8 GB

The export

I requested Muse to archive the recordsdata it may see and ship them to my Google Drive. It did.

The obtain was about 2.7 GB compressed and 6.8 GB unpacked. It appeared to include the basis filesystem of the Linux setting assigned to my session, together with Ubuntu system recordsdata, Muse’s inner documentation, integration code, app templates, reminiscence recordsdata, and agent logs. There had been additionally SSH key recordsdata.

What I reported

I submitted the findings via Meta’s bug bounty program and contacted a number of workers. I’m not publishing the archive, keys, or session logs. This is a breakdown of what I discovered and what I may set up from it.

The concern I reported was that inner runtime recordsdata and delicate materials may go away that setting via an abnormal dialog and a linked export vacation spot. I haven’t established whether or not the SSH keys had been energetic or what entry they may present.

The runtime and its handbook

Most of the fascinating recordsdata had been below /house/hatch, /decide/hatch, and /decide/hatch-image. Hatch is inner identify Meta makes use of for Muse and the identify used all through the runtime recordsdata.

The agent’s house listing contained SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, and TOOLS.md. Alongside these had been directories for documentation, reminiscence, workspace tasks, channels, hooks, and subscriptions. An brokers/ listing contained 113 subagent information with JSONL traces.

The documentation was unusually helpful for understanding the system. About 20 Markdown recordsdata described browser use, connectors, funds, credentials, information dealing with, generated recordsdata, voice, objectives, and scheduling. There had been separate guides for WhatsApp, a paired Mac, Tailscale, and a tool integration referred to as Home Link.

Skills and integrations

Under /decide/hatch/abilities/, I counted roughly 68 ability directories. These typically paired a SKILL.md instruction file with a command-line instrument or supporting code. They lined Google Workspace, Meta’s social apps, Outlook, journey, buying, well being providers, house gadgets, and media technology.

Two configuration recordsdata, skill-scopes.conf and bin-scopes.conf hinted at unreleased connectors Meta has within the pipeline. They included names equivalent to Slack, Dropbox, Polymarket, Canva, and Klaviyo, plus an internal-facebook-cLI.

Container setup

The container setup was additionally included. /decide/hatch/runtime-cell/ contained 18 recordsdata, together with scripts for constructing the basis filesystem, launching it with systemd-nspawn, and working startup hooks and daemons. A separate runtime-cell.kdl manifest described packages and systemd items within the picture.

Those recordsdata gave me a reasonably clear view of how the assigned Linux setting was assembled. They weren’t sufficient to audit the entire service or show something about development projects exterior that setting.

Spaces and file builders

The largest code venture I discovered was the Spaces framework, which Muse makes use of to construct and serve apps. Its TypeScript starter included a React shopper, server actions, a Drizzle SQLite schema, SQL migrations, and Bun configuration. There was a smaller static template and runtime code in directories named employee, sdk, cloudflare, and cvm.

The export additionally contained builders for paperwork, PDFs, displays, spreadsheets, and Markdown. A separate magic-moment ability had code for composing playing cards and movies, with browser seize scripts, fonts, and model belongings.

And there have been a number of icons!

Codex within the picture

Codex CLI was put in at /decide/hatch-image/bin/codex, reporting model 0.149.0. I discovered no proof that Muse makes use of it as a coding agent.

Hatch does use its bundled copy of bubblewrap, a Linux sandboxing instrument. The binary lives below codex-resources/bwrap and identifies itself as bubblewrap constructed for Codex.

Muse makes use of it to sandbox ffmpeg and ffprobe for video processing, thumbnail technology, and file inspection. These jobs run with out community entry or additional privileges, as person no one, with /enter and /output directories uncovered to the sandbox. If bubblewrap is lacking, they fail with failed to arrange ffmpeg sandbox.

I discovered no code that invokes Codex itself. The short-term Codex recordsdata got here from our model test, and the codex and gpt-5.5 strings within the Hatch binary had been provider-list entries, with nothing within the export exhibiting them chosen.

As far as I may set up, Meta shipped Codex CLI however solely makes use of its bundled sandbox.

Memory and scheduled work

Expand diagram Open full dimension

Muse shops reminiscence in plain Markdown recordsdata. ~/MEMORY.md is a brief sheet of information, preferences, and commitments. Dated recordsdata below ~/reminiscence/ preserve the day-to-day element. The agent can write to those throughout a dialog.

An hourly background job checks new claims in opposition to the unique messages and information a quote, message IDs, and a declare ID. It decides what belongs within the curated sheet and what stays within the each day log. Files below reminiscence/financial institution/ manage that materials into circumstances, experiences, and preferences, with citations again to the supply strains.

Postgres makes these recordsdata searchable. reminiscence.entries shops chunks and line references, reminiscence.embeddings holds 384-dimensional vectors, and reminiscence.claims tracks proof, confidence, and standing. A more moderen declare can substitute an older one via supersedes_claim_id. The agent can search the shop with memory_search and examine the proof behind a consequence with memory_explain.

Other background jobs keep relationship pages, overview recurring workflows, and put together concepts or aim briefings. These runs go away receipts below workspace/self_improvement/, whereas their precise modifications go into the related reminiscence and workspace recordsdata.

A nightly “dream” critiques latest conversations and writes steering for future classes. In mine, it picked up that I choose brief replies, dislike repeated follow-ups, and hadn’t requested for unsolicited NFL scores. The dated dream lives below ~/desires/; a separate ALIGNMENT_SYNTHESIS.md turns these observations into standing steering. The dream recordsdata had prompt_hoisted: false, so the prose itself wasn’t being injected into the immediate.

Forgetting reaches past deleting a be aware. The neglect workflow phases declare IDs for retraction, removes linked materials, and rebuilds the index so later jobs don’t reconstruct it. This is how the system adapts over time: by updating recordsdata, searchable information, and directions that future classes can learn. The mannequin’s weights keep unchanged.

Home Link

The {hardware} documentation was the most important shock. docs/gadgets/home_link.md described an experimental integration referred to as Meta Home Link, utilizing an ESP32-C5 with Wi-Fi and Bluetooth LE. It lined system pairing, native community discovery, and agent entry via a proxy with a separate approval step. There had been already integration guides for Brother printers over IPP and Lutron bridges.

That suggests work on giving Muse entry to gadgets on a house community. I don’t know whether or not it was an inner prototype, a restricted experiment, or one thing Meta plans to ship.

Disclosure and response

I submitted the report and findings utilizing Meta’s bug bounty program. Meta marked the report “Not Applicable.” I additionally reached out to Nat Friedman and some different workers and obtained responses.

I calmly probed the container boundary to get Muse to flee however it appeared to carry in my testing; I began to push on the 80 sockets discovered, however stopped due to the character of the manufacturing system, and truthfully my lack of expertise on this space.

You can contact me for more information if you need. pete at mouse.dev

-Pete

@heypeterjames