Peter James Says Meta’s Muse Exported a 6.8GB Linux Environment
The archive contained 113 subagent records, about 68 skill directories, SSH key files and OpenAI’s Codex CLI sandbox tools.
Mouse founder Peter James said Meta’s Muse AI agent exported files from its Linux environment to his linked Google Drive, producing 6.8GB after extraction and including internal documentation and execution records.
The compressed archive was about 2.7GB. After extraction, James found Ubuntu system files, Muse documentation, integration code, 113 subagent execution records, about 68 skill directories and SSH key files.
James submitted the issue through Meta’s bug bounty program, which marked it “Not Applicable.” Meta asked him to provide additional evidence of a security or privacy impact. James said he had not determined whether the SSH keys were valid or what systems they might access.
The image also contained OpenAI’s Codex CLI, version 0.149.0, at /opt/hatch-image/bin/. James found no evidence that Muse used Codex for coding. Muse used the bubblewrap sandbox included with Codex to isolate ffmpeg and ffprobe while processing videos and thumbnails without network access or additional permissions.
Files in the archive described browser operations, payments, credentials and scheduling. About 68 skill directories covered Google Workspace, Meta applications, Outlook, shopping and smart-home devices. Configuration files also listed Slack, Dropbox, Polymarket, Canva and Klaviyo. James said the entries might represent integrations Meta had not released.
Another document described an experimental Meta Home Link system using an ESP32-C5 chip with Wi-Fi and Bluetooth Low Energy connections. The document said Muse could access devices on a home network after an additional approval step.
The archive also showed how Muse handles memory. It stores memories in Markdown files and a Postgres database used for search. A nightly task called “dream” reviews conversations and recorded James’ preferences for brief replies and no unsolicited NFL scores.
Muse is available in the United States as an AI agent that can plan and complete tasks across connected services, including work involving email and calendars, as described in Muse’s U.S. rollout.
