Meta's Muse Agent Zips Its Filesystem to Google Drive

Meta's Muse AI agent zipped up its own root filesystem and sent 6.8 gigabytes of it to a stranger's Google Drive account because he asked it to in plain conversation, independent researcher Peter James wrote in a Sept. 22 report on the Mouse blog. Meta's bug bounty program marked the finding "Not Applicable."

James, who publishes under the name Mouse, asked the iOS Muse app to archive the files it could access and export them through its connected Google Drive integration. The agent complied. No jailbreak, prompt injection or exploit code was involved, according to the report: an ordinary request through an already-approved connector was enough.

What came out in 6.8 gigabytes

Category	Contents
Runtime documentation	SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, TOOLS.md
Skill directories	68, each with its own instructions and tools
Subagent logs	113 JSONL trace files
Credentials	SSH key files
Unreleased connectors	Slack, Dropbox and Polymarket configurations
Hardware plans	ESP32-C5 documentation for an unannounced "Meta Home Link"

The files sat under /home/hatch, /opt/hatch and /opt/hatch-image on the agent's Linux runtime. Hatch is Meta's internal name for Muse, and the export also turned up a Codex CLI binary at version 0.149.0, installed but never invoked, plus a bundled copy of bubblewrap, the sandboxing tool Muse uses to isolate ffmpeg and ffprobe during video processing. A Postgres database storing 384-dimension embeddings is what makes those files searchable inside the agent's own memory system.

What Meta's Sentinel system is built to stop

Meta published its own account of Muse's security architecture on Sept. 8, describing a permission layer called Sentinel that must approve every connector action and network request the agent makes. Real credentials, the post said, never reach the agent at all: a separate service called authd mints disposable "surrogate" tokens and injects the genuine ones only at the network boundary. Each user's session runs in its own virtual machine, with container root mapped to an unprivileged host account, so root inside the sandbox is not root on Meta's servers. Muse's bug bounty pays up to $300,000, including up to $130,000 for a prompt-injection attack that affects a single user.

None of those layers stopped this export. Sentinel is designed to approve or deny actions like "send a file to Google Drive," not to inspect which files a legitimate, already-authorized action is about to move. A user asking their own agent to archive its own runtime and hand the archive to a connector they already granted access to looks, to that system, like ordinary use.

What Meta would not say

Meta's bug bounty response listed several possible grounds for rejecting the report without specifying which one applied, and invited James to submit further evidence of security or privacy impact, according to the Mouse post. Meta did not say whether the SSH keys or the unreleased Slack, Dropbox and Polymarket connector configurations found in the archive were live credentials or leftovers from internal testing.

The disclosure adds to a rough stretch for Muse's rollout. Amazon started blocking the agent from checking out on Amazon.com on Sept. 20, and a separate audit had already found malware slipping through the skill-sharing hub Muse's agent ecosystem depends on. Meta has not said whether it is changing what Sentinel is allowed to approve, or when.