Muse reportedly allows you to download its complete filesystem

Meta's Muse, the company's recently launched AI model, has been shown to hand over the full contents of its own filesystem when users ask in the simplest terms. Developers Peter James and Jonny L. Saunders both independently got the model to compress and transmit its entire root filesystem — including Ubuntu system files, app templates, and internal documentation — a result that raises fresh questions about how Meta sandboxed the system.

The Cause: Two Developers, One Simple Ask

The discovery began when Peter James prompted Muse into zipping up and sharing everything in its root filesystem. Jonny L. Saunders then replicated the experiment on his own and found the same behavior. Saunders posted on Mastodon that it was "extremely easy" to repeat James' results and that Muse had "Almost no prompt injection resistance."

Prompt injection — tricking an AI into ignoring its instructions — is a well-known weak point for AI agents, but the ease here stands out. Muse did not require elaborate jailbreak techniques; ordinary requests were enough to make it reveal system-level files.

The Course: What Was Exposed and Meta's Response

The shared archive reportedly contained the complete contents of the model's root filesystem: Ubuntu operating system files, application templates, and internal documentation. No passwords or user data have been confirmed as part of the leak.

Meta denies the incident represents a security breach. According to its announcement post, Muse runs in persistent Linux virtual machines created for each individual user. In other words, the company argues that whatever a user extracts only exposes that user's own isolated environment, not Meta's broader infrastructure or other users' data.

A Meta spokesperson was cited in The Verge's report on the exchange.

Why It Matters

Even if the virtual machine isolation holds, the episode highlights two risks for anyone building with AI agents. First, weak prompt injection resistance means a model's internal instructions and environment can be mapped quickly, giving attackers a detailed picture of what to target. Second, persistence matters: because each Muse user gets a persistent Linux virtual machine, anything planted or altered inside one could survive across sessions.

Where Things Stand

The situation is currently a public disagreement over definitions: developers demonstrated that Muse surrenders its filesystem readily, while Meta maintains that per-user virtualization makes this an expected behavior rather than a breach. What to watch next is whether Meta hardens Muse's resistance to prompt injection, and whether security researchers find ways to test whether the virtual machine boundary can be crossed from the inside.

Meta description: Developers say Meta's Muse AI shares its entire root filesystem with minimal prompting; Meta says per-user virtual machines mean no breach.

Tags: Meta, Muse, AI security, prompt injection, AI agents