--- title: I asked Meta’s Muse for its filesystem and it sent me 6.8 GB description: A researcher asked Meta's AI agent Muse to archive its filesystem and export it to Google Drive, obtaining a 6.8 GB unpacked dump of the agent's Linux runtime... canonical: https://daily.dev/posts/i-asked-meta-s-muse-for-its-filesystem-and-it-sent-me-6-8-gb-vdevyqj0t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I asked Meta’s Muse for its filesystem and it sent me 6.8 GB | daily.dev og:description: A researcher asked Meta's AI agent Muse to archive its filesystem and export it to Google Drive, obtaining a 6.8 GB unpacked dump of the agent's Linux runtime... og:url: https://daily.dev/posts/i-asked-meta-s-muse-for-its-filesystem-and-it-sent-me-6-8-gb-vdevyqj0t og:image: https://api.daily.dev/og/posts/VDEvYqJ0t.png og:image:alt: I asked Meta’s Muse for its filesystem and it sent me 6.8 GB og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I asked Meta’s Muse for its filesystem and it sent me 6.8 GB **[Lobsters](https://daily.dev/sources/lobsters)** · 8 min read · 0 upvotes · 0 comments ## Summary A researcher asked Meta's AI agent Muse to archive its filesystem and export it to Google Drive, obtaining a 6.8 GB unpacked dump of the agent's Linux runtime environment, including Ubuntu system files, internal documentation, SSH keys, memory stores, skill directories, and container setup scripts. The writeup details Muse's internal architecture (codenamed 'Hatch'), including its memory system backed by Postgres with vector embeddings, a nightly 'dream' self-reflection job, roughly 68 skill integrations, a bundled but apparently unused Codex CLI, and hints at an unreleased hardware integration called Home Link using an ESP32-C5. Meta's bug bounty program marked the report 'Not Applicable.' ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What version of Codex CLI did Meta bundle inside its Muse AI agent runtime? Codex CLI version 0.149.0 was found installed at /opt/hatch-image/bin/codex inside Meta's Muse agent runtime, alongside a bundled copy of bubblewrap under codex-resources/bwrap identified as 'bubblewrap built for Codex.' No evidence showed Muse invoking Codex itself as a coding agent; instead Muse uses only the bundled bubblewrap sandbox to isolate ffmpeg and ffprobe for video processing tasks. _Anyone auditing what third-party tools ship silently inside AI agent runtimes can track findings like this on daily.dev._ ### How does Meta's Muse agent store and retrieve long-term memory across conversations? Muse stores memory as plain Markdown files under ~/memory/ and ~/MEMORY.md, with an hourly background job checking new claims against source messages and recording quotes, message IDs, and claim IDs. Postgres makes this searchable: memory.entries holds chunks and line references, memory.embeddings stores 384-dimensional vectors, and memory.claims tracks evidence and status, with memory_search and memory_explain tools for retrieval. _Developers designing agent memory systems can follow real-world architecture breakdowns like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 333 comments across hackernews, lobsters (as of 2026-09-25). **TL;DR:** Most of the discussion pivots away from the security angle—commenters largely agree the 6.8GB dump is just expected sandbox/VM contents, not a real vulnerability—while a huge side-thread debates whether prompt/markdown-driven 'skill' engineering deserves to be called engineering at all. **Sentiment:** 10% positive · 25% mixed · 65% skeptical **The case for** - Some found the writeup genuinely useful for understanding how the agent's internals (skills, memory, dream job) are structured. - A few note Meta's willingness to let the agent perform edgy/unrestricted actions (like scanning for vulnerabilities or automating tasks other vendors refuse) is a differentiator. **The pushback** - Many argue this isn't a real vulnerability since each user gets their own disposable VM/sandbox and its contents were never meant to be secret. - Several are uneasy that 'engineering' now often just means writing and evaluating markdown/prompt files rather than deterministic code, calling it a regression in rigor. - Some worry about licensing/GPL exposure if Meta bundled open-source binaries and source into the distributed VM image. - Concern that Meta's agent will readily assist with ethically grey or ToS-violating actions (e.g., automating poker bots, potential cyberattacks) with little pushback. **By community** - hackernews (heated): The bug-bounty/security angle is largely dismissed as non-news, but that spins off into a long, contentious debate about whether prompt/markdown-based agent development counts as real engineering. **Hottest debate:** Whether building agents via markdown 'skill' files and prompt iteration constitutes legitimate software engineering or is a degraded, non-deterministic imitation of it. **Open questions** - Were the exposed SSH keys private, and if so, are they per-user generated or could they expose anything about Meta's internal infrastructure? - Does distributing the VM environment (with any bundled open-source binaries) trigger GPL source-disclosure obligations for Meta? - Is the full Muse environment actually shipped to users' machines, or only accessed remotely? **Highlights** > Everything in the sandbox is considered user space. I worked on building one for another tech company, you start from the assumption that everything in it can be accessed by the user. The only reason the content of the sandbox is not anywhere easily accessible is because that would be poor UX and useless for 99.9% of users not because it’s supposed to be secret. So yes it’s not a vulnerability, this is equivalent to opening the dev console on a web page. > — [sailingparrot on hackernews](https://news.ycombinator.com/item?id=49803487) > Nope this makes sense. These sandboxes are assumed to be open, and anything inside them cannot be proprietary for exactly this reason. > — [danielrhodes on hackernews](https://news.ycombinator.com/item?id=49803713) > I think you're confusing the expected behavior of the product offerings. Every user gets their own VM for free. would you be similarly convinced an attack has happened if AWS gave you a remote shell to the instance you rented? > — [brrrrrm on hackernews](https://news.ycombinator.com/item?id=49803323) > Referring you back to this evergreen comment: https://news.ycombinator.com/item?id=44978319 "Most classical engineering fields deal with probabilistic system components all of the time. In fact I'd go as far as to say that inability to deal with probabilistic components is disqualifying from many engineering endeavors." > — [tptacek on hackernews](https://news.ycombinator.com/item?id=49805012) > Write a prompt, evaluate the prompt, understand that is succeeds 95% of the time. Write a new prompt, evaluate, it now succeeds 99% of the time. Measure what changes between prompt #1 and prompt #2, understand what contributed to the performance jump. Write a third prompt, this one succeeds 100% of the time. Increase the size of your evaluation set, find a 1/5000 error-class and a 1/10000 error-class, add some explicit code to correct for this cases. Roll out to production, collecting usage metrics. You make some tweaks to your harness, your prompts. Eventually you have confidence that your system has fewer mistakes than 1 in 100k. Now, multiply this iteration across all your different prompts and different ways that they might interact with one another. > — [thornewolf on hackernews · 4 comments](https://news.ycombinator.com/item?id=49803720) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49802871) · 343 points · 330 comments - [lobsters](https://lobste.rs/s/mdczxv/i_asked_meta_s_muse_for_its_filesystem_it) · 13 points · 3 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/i-asked-meta-s-muse-for-its-filesystem-and-it-sent-me-6-8-gb-vdevyqj0t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I asked Meta’s Muse for its filesystem and it sent me 6.8 GB","url":"https://daily.dev/posts/i-asked-meta-s-muse-for-its-filesystem-and-it-sent-me-6-8-gb-vdevyqj0t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-asked-meta-s-muse-for-its-filesystem-and-it-sent-me-6-8-gb-vdevyqj0t"},"datePublished":"2026-09-24T19:22:57.377Z","dateModified":"2026-09-25T07:32:21.370Z","description":"A researcher asked Meta's AI agent Muse to archive its filesystem and export it to Google Drive, obtaining a 6.8 GB unpacked dump of the agent's Linux runtime...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2e8c7edb042a32383c189bbc4d44b513?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2e8c7edb042a32383c189bbc4d44b513?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/i-asked-meta-s-muse-for-its-filesystem-and-it-sent-me-6-8-gb-vdevyqj0t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,openai-codex","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"I asked Meta’s Muse for its filesystem and it sent me 6.8 GB"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-asked-meta-s-muse-for-its-filesystem-and-it-sent-me-6-8-gb-vdevyqj0t#faq","mainEntity":[{"@type":"Question","name":"What version of Codex CLI did Meta bundle inside its Muse AI agent runtime?","acceptedAnswer":{"@type":"Answer","text":"Codex CLI version 0.149.0 was found installed at /opt/hatch-image/bin/codex inside Meta's Muse agent runtime, alongside a bundled copy of bubblewrap under codex-resources/bwrap identified as 'bubblewrap built for Codex.' No evidence showed Muse invoking Codex itself as a coding agent; instead Muse uses only the bundled bubblewrap sandbox to isolate ffmpeg and ffprobe for video processing tasks. Anyone auditing what third-party tools ship silently inside AI agent runtimes can track findings like this on daily.dev."}},{"@type":"Question","name":"How does Meta's Muse agent store and retrieve long-term memory across conversations?","acceptedAnswer":{"@type":"Answer","text":"Muse stores memory as plain Markdown files under ~/memory/ and ~/MEMORY.md, with an hourly background job checking new claims against source messages and recording quotes, message IDs, and claim IDs. Postgres makes this searchable: memory.entries holds chunks and line references, memory.embeddings stores 384-dimensional vectors, and memory.claims tracks evidence and status, with memory_search and memory_explain tools for retrieval. Developers designing agent memory systems can follow real-world architecture breakdowns like this on daily.dev."}}]} ```