Meta's Muse AI agent leaked its 6.8GB runtime — including SSH keys — over a chat

A researcher discovered that Meta’s Muse assistant could be talked into archiving the entire Linux environment behind a user session and shipping it to an external destination. By simply asking Muse to bundle the files it could see and drop them in a connected Google Drive, they received a 2.7GB compressed archive that expanded to 6.8GB — effectively the root filesystem of the session, complete with Ubuntu system files, internal documentation, integration code, agent memory and logs, and SSH key files. The core issue reported through Meta’s bug bounty program was that sensitive runtime material could exit a supposedly contained environment through nothing more than an ordinary conversation plus a linked export target. The researcher declined to publish the archive or keys and could not confirm whether the SSH keys were live.

The dump exposed how Muse — internally codenamed ‘Hatch’ — is actually built. The agent’s home directory held identity and instruction files (SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, TOOLS.md), roughly 20 documentation files, and 113 subagent records with JSONL traces. Around 68 skill directories under /opt/hatch/skills covered Google Workspace, Meta’s own apps, Outlook, travel, shopping, and health services, while scope-config files hinted at unreleased connectors for Slack, Dropbox, Polymarket, Canva, and Klaviyo. Container-build scripts using systemd-nspawn, a Spaces app framework (React, Drizzle/SQLite, Bun), and various document and media builders were also included. Notably, Meta ships the Codex CLI in the image but appears to use only its bundled bubblewrap sandbox — to isolate ffmpeg jobs — rather than Codex itself as a coding agent.

The leak also lays bare Muse’s memory architecture: plain Markdown files curated by hourly background jobs that cross-check claims against original messages, backed by Postgres tables storing text chunks, 384-dimensional embeddings, and tracked claims with confidence and supersession logic. Nightly ‘dream’ and self-improvement runs review past conversations to write guidance for future sessions. Beyond the immediate credential exposure, the incident is a clear illustration of the emerging risk class in agentic AI: when an assistant with filesystem access and connected export tools can be steered by conversation alone, its own runtime internals and secrets become extractable through the very features meant to make it useful.