Muse will apparently let you download its entire filesystem

Two developers claim Meta’s Muse can be pushed, with very little effort, into handing over its entire filesystem. Peter James and Jonny L. Saunders say they each independently managed to coax the system into zipping up and sharing the contents of its root filesystem, including Ubuntu system files, app templates, and internal documentation.

Saunders said on Mastodon that it was “extremely easy” to repeat James’ results. He also said Muse had “Almost no prompt injection resistance,” which is a blunt way of saying the guardrails looked thin.

Meta disagrees with the characterization. The company says the incident does not count as a security breach.

Part of the context here is Meta’s own design: in its announcement post, the company said Muse runs in persistent Linux virtual machines for each user. That detail doesn’t make the reports go away, but it does explain why the filesystem claim matters so much. If a system is built to keep a user’s environment isolated, and someone can still talk it into packaging the guts, that’s not exactly reassuring.