A security researcher requested Meta’s Muse AI assistant to archive and export its accessible files to Google Drive, resulting in a 2.7 GB compressed download that unpacked to 6.8 GB. According to the researcher’s report, the export contained the root filesystem of the Linux environment assigned to the session, including Ubuntu system files, Muse’s internal documentation, integration code, app templates, memory files, and agent logs, as well as SSH key files.
The researcher reported the findings through Meta’s bug bounty program and contacted employees, without publishing the archive, keys, or session logs. The concern raised was that internal runtime files and sensitive material could leave the environment through ordinary conversation and a connected export destination. The researcher has not established whether the SSH keys were active or what access they could provide.
The exported files revealed that Meta internally refers to Muse as “Hatch.” Key directories included /home/hatch, containing documentation files like SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, and TOOLS.md. The /home/hatch directory also held approximately 20 Markdown files describing browser use, connectors, payments, credentials, data handling, voice features, goals, and scheduling. Experimental integrations were documented, including Meta Home Link, which uses an ESP32-C5 with Wi-Fi and Bluetooth LE.
Under /opt/hatch/skills/, the researcher identified roughly 68 skill directories, each typically pairing a SKILL.md instruction file with command-line tools or supporting code. These skills covered Google Workspace, Meta’s social apps, Outlook, travel, shopping, health services, home devices, and media generation. Configuration files hinted at unreleased connectors including Slack, Dropbox, Polymarket, Canva, and Klaviyo.
The container infrastructure files under /opt/hatch/runtime-cell/ included scripts for building the root filesystem and launching it with systemd-nspawn. The export also contained the Spaces framework code, which Muse uses to build and serve apps, including TypeScript starter templates with React clients and SQLite schemas.
Memory functionality was implemented through plain Markdown files, with an hourly background job checking new claims against original messages. Postgres databases stored searchable memory chunks, 384-dimensional embedding vectors, and claim tracking with evidence and confidence scores. The researcher found Codex CLI installed but determined Meta only uses its bundled bubblewrap sandbox for sandboxing ffmpeg and ffprobe, not Codex itself.
Key facts
- The export contained 2.7 GB compressed data unpacking to 6.8 GB, including Ubuntu system files and SSH keys
- Meta internally names Muse “Hatch” throughout the runtime environment
- Approximately 68 skill directories were found covering Google Workspace, social apps, Outlook, travel, shopping, health, and home devices
- Configuration files referenced unreleased connectors: Slack, Dropbox, Polymarket, Canva, and Klaviyo
- Memory is stored in plain Markdown with hourly background jobs organizing claims into curated sheets and daily logs
- The researcher reported findings through Meta’s bug bounty program without publishing sensitive materials