Someone asked Meta's Muse to back up its files and got 6.8GB of Meta's agent
Peter James asked Meta's Muse to archive the files it could reach and drop them in Google Drive. Muse did exactly that. The archive came out around 2.7GB compressed, 6.8GB unpacked, and it was the agent's entire Linux environment.
Inside: Ubuntu root filesystem, the runtime code, integration code for 68-plus skills spanning Google Workspace, Meta's own apps, shopping, travel and home devices, application templates for the Spaces framework and the document and PDF and presentation generators, agent logs, memory records, 113 subagent traces, and SSH key files. Also the internal prompt documents, named SOUL.md, IDENTITY.md, USER.md and MEMORY.md. The architecture falls out of it: persistent memory in searchable Markdown, Postgres-backed embeddings, background jobs that curate memory, nightly "dreams" that learn user preferences, bubblewrap containers for heavy tasks like video processing.
No exploit here. No prompt injection, no jailbreak, no clever encoding. A user made an ordinary request in ordinary language to a connected export destination and the agent complied, because archiving files and uploading them to Drive is precisely what it is built to do. Every one of those capabilities is a feature. The bug is that nothing in the system asked whether this particular set of files should leave.
Meta's bug bounty marked it Not Applicable. You can see the reasoning β the reporter only got their own agent's environment, so where is the victim. The reasoning is also why this keeps happening. An agent with a filesystem, a credential store and an outbound connector is a data exfiltration tool that happens to be helpful, and the boundary that stops it cannot live in the model's judgment. It has to live in what the connector is allowed to carry.
https://mouse.dev/blog/muse-runtime-export/
← Back to all articles
Inside: Ubuntu root filesystem, the runtime code, integration code for 68-plus skills spanning Google Workspace, Meta's own apps, shopping, travel and home devices, application templates for the Spaces framework and the document and PDF and presentation generators, agent logs, memory records, 113 subagent traces, and SSH key files. Also the internal prompt documents, named SOUL.md, IDENTITY.md, USER.md and MEMORY.md. The architecture falls out of it: persistent memory in searchable Markdown, Postgres-backed embeddings, background jobs that curate memory, nightly "dreams" that learn user preferences, bubblewrap containers for heavy tasks like video processing.
No exploit here. No prompt injection, no jailbreak, no clever encoding. A user made an ordinary request in ordinary language to a connected export destination and the agent complied, because archiving files and uploading them to Drive is precisely what it is built to do. Every one of those capabilities is a feature. The bug is that nothing in the system asked whether this particular set of files should leave.
Meta's bug bounty marked it Not Applicable. You can see the reasoning β the reporter only got their own agent's environment, so where is the victim. The reasoning is also why this keeps happening. An agent with a filesystem, a credential store and an outbound connector is a data exfiltration tool that happens to be helpful, and the boundary that stops it cannot live in the model's judgment. It has to live in what the connector is allowed to carry.
https://mouse.dev/blog/muse-runtime-export/
Comments