I asked Meta’s Muse for its filesystem and it sent me 6.8GB

The export of Meta's AI assistant's filesystem contains sensitive data, including SSH keys, which could be exploited.

A security researcher obtained a 6.8GB archive of Meta's Muse AI assistant's root filesystem by asking it to export its data. The archive, compressed to 2.7GB, contained system files, internal documentation, integration code, application templates, memory files, agent logs, and potentially sensitive SSH key files. The researcher found this material within directories related to 'Hatch,' the internal name for Muse. This export also included details about the AI's skills, integrations with various services like Google Workspace and Meta's own social apps, and experimental features like 'Meta Home Link.' The research highlights concerns about the potential for sensitive runtime information to be exfiltrated through ordinary conversations with the AI. The researcher reported these findings through Meta's bug bounty program.

The discovery reveals a significant potential for data leakage from AI assistants, as internal runtime files, documentation, and potentially active SSH keys were accessible and exfiltrated through a standard user request. This incident suggests that current security measures for AI agent environments may be insufficient to contain sensitive operational data, raising concerns for companies deploying similar technologies. The incident prompts a re-evaluation of how AI models store and manage their internal states and operational data, especially when connected to external storage or communication channels.

The implications extend to how AI model security is perceived and audited, moving beyond just the AI's outputs to its underlying infrastructure and data access. Organizations developing or utilizing AI agents must now consider the security posture of the entire execution environment, including how to prevent unintended data disclosure. This event underscores the need for more robust sandboxing, stricter data access controls, and transparent auditing mechanisms for AI systems, particularly those handling proprietary code or sensitive user information.