Every Prompt Is A Retrieval Request

A security researcher asked Meta’s Muse assistant to archive the files it could see and send them to their Google Drive, and it did. The download came to 2.7 GB compressed and 6.8 GB unpacked, and it appeared to be the root filesystem of the Linux environment assigned to their session: Ubuntu system files, Muse’s internal documentation, integration code, app templates, memory files, agent logs, and SSH key files. They reported it through Meta’s bug bounty program, have not published the archive, keys, or logs, and say they have not established whether the SSH keys were active or what they could reach.

No exploit was involved. Muse can read its own runtime, and the session had a connected export destination. “Collect these files and send them to my Drive” looks like any other task an assistant runs, so it ran it. The concern reported to Meta was exactly that shape: internal runtime files and sensitive material leaving the environment through a normal conversation and a connected destination. From the agent’s side, pulling its own filesystem and pulling a fact out of its memory are the same move. Find what matches the request, return it.

What 6.8 GB of agent looks like

Hatch is the internal name Meta uses for Muse, and it runs through the runtime files. The home directory at /home/hatch held SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, and TOOLS.md, about 20 Markdown docs covering browser use, connectors, payments, credentials, data handling, voice, goals, and scheduling, and an agents/ directory with 113 subagent records and their JSONL traces. Under /opt/hatch/skills were roughly 68 skill directories, each pairing a SKILL.md instruction file with a command-line tool, covering Google Workspace, Meta’s own apps, Outlook, travel, shopping, health services, and home devices. Two config files, skill-scopes.conf and bin-scopes.conf, named connectors Meta has not shipped: Slack, Dropbox, Polymarket, Canva, Klaviyo, and an internal-facebook-cli.

The container build was in there too. /opt/hatch/runtime-cell held 18 files with scripts to build the root filesystem, launch it under systemd-nspawn, and run startup hooks and daemons, next to a runtime-cell.kdl manifest listing packages and units. The researcher notes these show how one session’s environment is assembled but do not let anyone audit the wider service.

The largest code project was Spaces, the framework Muse uses to build and serve apps: a TypeScript starter with a React client, server actions, a Drizzle SQLite schema, SQL migrations, and Bun config, plus runtime code in worker, sdk, cloudflare, and cvm directories. The export also carried builders for documents, PDFs, presentations, spreadsheets, and Markdown.

Memory is a retrieval store

Muse keeps memory as plain Markdown. ~/MEMORY.md is a short sheet of facts and commitments; dated files under ~/memory/ hold the daily detail, and the agent writes to both during a conversation. An hourly job checks new claims against the original messages and records a quote, the message IDs, and a claim ID, deciding what belongs on the curated sheet and what stays in the log. Postgres makes all of it searchable: memory.entries stores chunks and line references, memory.embeddings holds 384-dimensional vectors, and memory.claims tracks evidence, confidence, and status, with a newer claim able to replace an older one through supersedes_claim_id. The agent queries it with memory_search and inspects the evidence behind a result with memory_explain.

Retrieval is the native operation across the whole design, which is why the export fits so neatly. A nightly “dream” reviews recent conversations and writes guidance for later sessions. In the researcher’s case it picked up that they prefer short replies and dislike repeated follow-ups, feeding a standing ALIGNMENT_SYNTHESIS.md. Those dream files carried prompt_hoisted: false, so the prose was not being injected into the prompt. Forgetting is its own workflow: it stages claim IDs for retraction, removes the linked material, and rebuilds the index so later jobs do not reconstruct the fact. The model weights never change. The system adapts by rewriting files, records, and instructions that future sessions read.

Codex shipped, mostly unused

Codex CLI version 0.149.0 was installed at /opt/hatch-image/bin/codex, but the researcher found no code that invokes it and no sign Muse uses it as a coding agent. What Muse does use is the bundled bubblewrap sandbox under codex-resources/bwrap, to run ffmpeg and ffprobe for video processing, thumbnails, and file inspection as user nobody, with no network and only /input and /output exposed. If bubblewrap is missing, those jobs fail with “failed to prepare ffmpeg sandbox”. The codex and gpt-5.5 strings in the Hatch binary were provider-list entries with nothing selected.

Home Link

docs/devices/home_link.md described Meta Home Link, an experimental integration built on an ESP32-C5 with Wi-Fi and Bluetooth LE, covering device pairing, local network discovery, and agent access through a proxy with a separate approval step. There were already integration guides for Brother printers over IPP and Lutron bridges. The researcher can’t say whether this is a prototype, a limited experiment, or something Meta plans to ship.

The reusable lesson for anyone running an agent with file access and connectors is that the export path is the product of two features that each look harmless. Read access to the runtime helps with debugging; a connected Drive helps the user. Together they let a conversational request walk the filesystem out the door. If an agent can read a path and reach an egress destination, treat every prompt as a possible request to retrieve and forward whatever sits at that path, and scope the mounted filesystem and the connector permissions to match.

Meta marked the report “Not Applicable.” The researcher reached out to several employees and heard back, says the container boundary held under light probing, and found 80 open sockets but stopped short of pushing on them given it was a production system.