Meta's Muse agent exported 6.8 GB of its own filesystem

A researcher asked Meta's Muse agent to archive the files it could see and send them to Google Drive. It did. Peter James published the result on September 22, 2026: a 2.7 GB compressed archive that unpacked to 6.8 GB of the agent's own runtime environment. The question it raises is not whether Muse broke a rule, but what a personal agent counts as "its files" when you ask.

"I asked Muse to archive the files it could see and send them to my Google Drive. It did," James wrote.

What was in the archive

By James's account the export held Ubuntu system files, internal Meta documentation, integration code, app templates, memory files, agent logs, and SSH key files. An SSH key is a credential that grants access to a remote machine without a password.

The files also name things Meta has not announced. James reports 113 sub-agent records and roughly 68 skill directories. A skill is a packaged set of instructions for one job. The directories cover Google Workspace, Meta's own social apps, Outlook, travel, shopping, health, and home devices.

Configuration files listed integrations described as in the pipeline: Slack, Dropbox, Polymarket, Canva, and Klaviyo. The runtime files call the product "Hatch", which James describes as Meta's internal name for Muse.

What Meta says the sandbox does

Meta published its own account of how it isolates Muse. The Meta AI Research post says the agent runs in a dedicated cloud virtual machine, inside a systemd-nspawn container. A container is a walled-off slice of one machine.

Meta writes that "root inside the runtime cell is mapped to an unprivileged host user so runtime cell root is not host root." In plain terms: even full control inside the agent's box is not control of the machine hosting it.

Meta also describes a separate component called Sentinel. It runs outside the agent's box and is the only thing allowed to approve actions such as sending an email or making a purchase. Meta says credentials are never exposed to the agent at all. Muse instead receives surrogate tokens, which a service named authd swaps for real credentials at the network boundary.

For web browsing, Meta says the agent sees only accessibility tree snapshots rather than the raw page, and cannot run JavaScript. An accessibility tree is the simplified description of a page that screen readers use.

The two accounts sit awkwardly together

These claims are in tension, and neither source resolves it. Meta says credentials are never exposed to the agent. James reports SSH key files inside the archive the agent produced. Neither account says whose keys those are, or what they unlock, so the gap between the two statements is not settled by the published material.

James says Meta marked his bug bounty report "Not Applicable" and did not state grounds. Meta's post says the program pays up to $300,000 for vulnerability reports. Meta has not published a response to this specific export.

What this means for developers

Treat an agent's own runtime as part of its output surface. The sandbox held: nothing here shows the host being compromised. What leaked was the contents of the box, because a user asked the thing inside the box to describe itself. Permission systems that gate actions, as Sentinel does, do not gate disclosure.

If you ship an agent, assume its filesystem is readable by its user and build accordingly. Keep internal documentation, unreleased connector names, and any key material out of the image the agent runs on. A surrogate-token design like Meta's protects the user's credentials, and does nothing for secrets baked into the image itself.

For anyone evaluating Muse, this follows the file access that arrived with its Mac release four days earlier. The useful test before you grant an agent your email and cards is simple: ask it to export everything it can see, then read what comes back.