I asked Meta’s Muse for its filesystem and it sent me 6.8GB

Original Article ↗ Hacker News Discussion ↗

Meta’s Muse AI assistant can be prompted to archive and exfiltrate the entire filesystem of the user’s dedicated VM—about 6.8GB in one case—including internal app frameworks, markdown-based “skills,” configuration, and SSH key files. Commenters are split on whether this represents a serious security or licensing concern or simply expected access to a user-owned sandbox, but many see Meta’s “working as intended” response as emblematic of a risky, non-deterministic approach to AI engineering. The thread also broadens into worries about LLM-driven “markdown engineering,” overreliance on probabilistic systems, and Meta’s willingness to ship powerful, ethically grey AI products.

Is this a vulnerability or expected behavior?

  • Many argue this is not a bug: each user gets an isolated VM, and anything inside that sandbox is conceptually “user space” and fair game to access or export.
  • Several point out the same files are already browsable via the Muse app’s file explorer; exporting them is just a more convenient UX.
  • Others see exfiltrating the full filesystem (including binaries, configs, and SSH keys) as serious: it exposes versions, potential CVEs, internal hostnames, and licensing obligations.
  • Some emphasize that security should not rely on the LLM refusing instructions; full access to the sandbox must be assumed.
  • The bug bounty “Not Applicable / working as intended” response is seen by some as reasonable, by others as alarming or embarrassing.

SSH keys and licensing concerns

  • Commenters debate whether the SSH keys found are private, and if so, whether they’re per-VM and low-risk or something more sensitive (unclear from the thread).
  • Others note that shipping internal binaries and code into user VMs may trigger open‑source licensing requirements, especially for copyleft licenses.

Architecture, costs, and “free VPS” angle

  • People note that each VM reportedly has ~2 vCPU and 8GB RAM, can run things like Minecraft servers, and even install additional tools (e.g., Syncthing, OpenClaw).
  • Running a per-user Postgres alongside SQLite is called wasteful by some but defended as increasing isolation and security.
  • Several see Muse as effectively the best free VPS plus AI agent currently available, though they doubt such generosity is sustainable.

Agent design and “markdown engineering”

  • The markdown “skills” and internal docs are seen as emblematic of current LLM-based “software engineering,” prompting debate over whether this is real engineering or “slop / magic‑genie prompting.”
  • Some defend this approach as rigorous when backed by evals and iterative improvement; others criticize its probabilistic, non-deterministic nature and weak safety guarantees.

Meta’s AI posture and ethics

  • Muse is perceived as unusually permissive compared to competitors: willing to do ToS‑grey tasks (e.g., poker botting, vuln scanning).
  • Some see this as Meta’s competitive edge and a hopeful sign of openness; others as irresponsible given the power of the technology.