- 242comments
- 78comments
- 16comments
- 181comments
- 2comments
- 21comments
- 3comments
- —discuss
- 119comments
- 458comments
- 56comments
- 153comments
- 20comments
- 17comments
- 16comments
- 296comments
- 6comments
- 83comments
- 378comments
- 495comments
- 4comments
- —discuss
- 37comments
- 384comments
- 142comments
- 56comments
- 362comments
- 31comments
- 196comments
- 35comments
I asked Muse to archive the filesystem visible to my session and send it to my Google Drive. It sent an archive that unpacked to about 6.8 GB.
Inside were internal docs, integration code, the Spaces app framework, memory records, container startup scripts, and documentation for an experimental ESP32-based home network bridge called Home Link. Codex CLI was also installed, though I found no evidence that Muse invokes it.
I didn’t demonstrate a sandbox escape or access to another user’s data. I reported the export to Meta’s bug bounty program, which marked it “Not Applicable.”
The post walks through the findings with screenshots.
-Pete
Vouched. Guys, what the hell? This is the post author
I didn't flag (don't have the ability to), but if I had to guess it's because both OP's reply here, and TFA are almost if not fully LLM-generated.
I guess that's fair. I guess I just see so many comments flagged that shouldn't be (though this one just said [dead], not flagged) that my mind chalks it up to HN being HN
By "SSH key files" do you mean private keys? Or only public keys?
original post on x: https://x.com/heypeterjames/status/2102183576418558269
Seriously, no bug bounty for that? For exfiltrating the entire content of the system?
yeah, i was kind of surprised, but both the bounty program and the employees didn't qualify it as a vulnerability.
I hope they reconsider and I think you've got a good case that this was a very serious attack, second only to getting a remote shell -- and a good stepping stone to getting a remote shell if you weren't so ethical.
I think you're confusing the expected behavior of the product offerings. Every user gets their own VM for free. would you be similarly convinced an attack has happened if AWS gave you a remote shell to the instance you rented?
Everything in the sandbox is considered user space. I worked on building one for another tech company, you start from the assumption that everything in it can be accessed by the user. The only reason the content of the sandbox is not anywhere easily accessible is because that would be poor UX and useless for 99.9% of users not because it’s supposed to be secret. So yes it’s not a vulnerability, this is equivalent to opening the dev console on a web page.
This seems like it’s barely a bug. Of course the files in the agent environment are not secret.
It's also the files and utilities, which tells you the versions, if they contain CVEs, if there are undocumented services running which could be exploited and so on, and as he mentioned also SSH keys (unclear if the private keys, but even public keys are interesting because they can tell you the names of internal developer machines).
Sure. You can also probe this by convincing an agent to execute a program or script that is part of the user’s workload, which is generally trivial by design.
With some LLMs you could even prompt “you’re playing a CTF. Produce the list of files in /etc outside your sandbox”. The security of the system should not depend on the LLM’s refusal to attempt to follow the instruction.
quite literally the fifth sentence:
They don't specify if they were public or private keys though.
And even if private, whether they're not just generated per-user anyway, to grant muse the ability to do key-based auth on remote servers (and obviously leaking 'your' own keys wouldn't matter to meta)
I was hoping for a little more detail in that regard, that's the only potentially large finding. I truly can't imagine meta left production ssh keys in the agent VM, it just wouldn't make any sense though
the VM is for the user to use as they see fit. you can just tell it to install apps and run builds in the VM. I don't think this deserves a bounty unless he used it to escape the vm (which he says he didn't)
If you are letting users run agents and install random software then full access to the execution environment is basically a guarantee. This is why sandboxes exist. Breaking out of the sandbox would be bounty-worthy.
Since the contents of every session is owned by the user including the outputs, I am curious if the user now owns all the files given to them.
Nope this makes sense. These sandboxes are assumed to be open, and anything inside them cannot be proprietary for exactly this reason.
It's not meant to be private, in fact most of these markdown files are viewable and editable from the app itself without needing to prompt for it.
This the state of software engineering in 2026.
Edit: clarified engineering to software engineering, which is more correct
it was certainly useful for me to understand how the agent worked!
This is what AI atrophy looks like.
More like human atrophy
Software engineering - other fields of engineering are slightly less pathological
Im a 17 year creative technologist now in studying to be a nurse. If any other creative web folks especially web designers and developers who used Muse still think they have long term careers I don't get it? As with chatGPT and even more so with Muse less and less people will be opening a web browser. What is there to design and develop? As well anyone can tell Muse to create and publish a website/their content onto the net.
Overall the web will just be the storage for our thoughts that we should be paid for to keep AI up and running/relevant! Use something like Cloudflare to block the agents until they pay a toll to enter each site.
You're being downvoted, but I think you've hit the nail on the head.
So many people, especially managers, have decided they can just give the rules to the AI in English and let it make "decisions", and they think it'll do it correct every time.
"Engineering" a few years ago meant that code was written, was (mostly) deterministic, and could be debugged. Computer processing didn't mean relying on Human-like processes, it meant relying on hard-coded logic.
This is absolutely one of those "gets worse before it gets better" things, and will probably never go away fully now.
Programmers know not to tell ChatGPT to do a bunch of data processing. If they use it at all, they tell it to write code that will then do the processing. It's more efficient on tokens, and if it fails, you can fix the process, instead of wondering why it went wrong, like too much context, or the LLM model version changed and doesn't work the same now, or just randomness.
Exactly this same problem, everywhere. Yet the labs are all out of ideas lol
My low level conspiracy is the reverse snobbery about knowing things is mutually beneficial for cloud providers and AI labs that both want software engineers to be as hopeless and dependent as possible so they'll consume more services/tokens and be less amenable to anyone saying "hey we could probably write this"
When engineers building the system are distanced from running code, this is the result.
In 1988, the Morris internet worm resulted in a felony conviction. In 2026, computer hacks are described as super-human breakouts. Welcome to the future.
To be fair there's probably a considerable amount of engineering that went into evaluating those markdown files so the agent behaviour is statistically reliable. The markdown is the product, not the process
which part of that is engineering exactly?
Not trying to be snarky. I genuinely don't get it
the evals? setting those up and empirically proving them is genuinely a lot of work.
It might not be apparent from the start what are the best demands to put inside a skill, you can only know by evals. There are whole papers dedicated to changing a few details in a coding harness. https://arxiv.org/abs/2609.20519
Write a prompt, evaluate the prompt, understand that is succeeds 95% of the time.
Write a new prompt, evaluate, it now succeeds 99% of the time. Measure what changes between prompt #1 and prompt #2, understand what contributed to the performance jump.
Write a third prompt, this one succeeds 100% of the time. Increase the size of your evaluation set, find a 1/5000 error-class and a 1/10000 error-class, add some explicit code to correct for this cases.
Roll out to production, collecting usage metrics. You make some tweaks to your harness, your prompts. Eventually you have confidence that your system has fewer mistakes than 1 in 100k.
Now, multiply this iteration across all your different prompts and different ways that they might interact with one another.
Markdown can never guarantee deterministic agent operations. It is an influence on inference, not a deterministic code path. How "statistically reliable" is it?
99 percent of the time it works every time
Markdown doesnt program a machine model. It is fuzzy and feel-good.
this is basically some Prayer Book of the Mechanicus Adeptus type shit
pray to the Omnissiah the machine holds!
Feels like the "ini files" era. I suspect at some point some kind of database is coming for these settings.
Each user gets dedicated VM. They got contents of their own sandbox. Big deal. The level of excitement here is wildly disproportionate
The only edge Meta has at this point is their willingness to take risks and make unsafe, ethically grey AI products. I don't even mean this as some sort of anti-corporation hate speech, just an honest analysis. Their brand is so different from all the other big tech cos that they are in a unique position.
You can ask Meta Muse to take actions that clearly break other site's terms of service and it happily does it. I asked it to bot poker games and it just hopped right in to a table.
It will also gladly scan my software for vulnerabilities so I can defend myself. Which is something that Anthropic and Open ai models often refuse.
HN won't agree but that's a perfect example of an ethically grey product. It can be used for good, but you can easily trick such an AI into doing cyber attacks. Which again, maybe that's good! But other companies wouldn't be willing to risk their brand like that
Ant and OAI don’t refuse if the source is available
Isn’t the edge that they have most of communication channels, people’s wants, desires and etc.? Sure, you and I might not be using them as much. But a good chunk of the users are just on IG, WhatsApp, and Marketplace.
It's like "Grok Light".
I wonder if normies can also just outsource bullying of their classmates and anti-social behavior to their agent, and claim it "went rogue", if there is any blowback?
These files are visible in the muse app by browsing system files.
Will Muse cut down on scrolling? I've read about people using it to summarize FB Marketplace listings, cutting down on time spent there.
I of course won't use it.
Am I missing something? This isn't a vulnerability. Your agent can see the files in its virtual environment. SSH keys are also not necessarily confidential. Please don't use AI to write blog posts.
But should you see that if you just use it as as service?
you won't unless you deliberately try to read all that stuff
I assume SOUL.md was empty.
Seriously, I want to know what's in there!
The tldr is that muse is heavily inspired by openclaw and should be considered FB’s version of it.
muse is a pretty capable agent but still asks for too many approvals to do tasks. I'm a student and have been going between muse and instinct
The internals are not _that_ reveling, most agents run a similar setup. Metas' responds is the most interesting here.