Muse will apparently let you download its entire filesystem

Muse 似乎允许你下载其整个文件系统

A pair of developers say that with very little prompting, Meta’s Muse will share its entire filesystem with you. Peter James and Jonny L. Saunders have said they both independently coaxed Muse into zipping up and sharing the entire contents of its root filesystem, Ubuntu system files, app templates, and internal documentation. Saunders posted on Mastodon that it was “extremely easy” to replicate James’ results and that Muse had “Almost no prompt injection resistance.”

两位开发者表示，只需稍加引导，Meta 的 Muse 就会与你共享其整个文件系统。Peter James 和 Jonny L. Saunders 称，他们两人都独立地诱导 Muse 将其根文件系统、Ubuntu 系统文件、应用模板和内部文档的全部内容打包并共享。Saunders 在 Mastodon 上发帖称，复现 James 的结果“极其容易”，而且 Muse “几乎没有针对提示词注入的防御能力”。

Meta denies that the incident represents a security breach. As noted in its announcement post, Meta’s Muse runs in persistent Linux virtual machines for each user. Meta spokesperson Daniel Roberts said, “Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data.” Unlike with the average laptop, however, the data potentially reveals some interesting things about how Meta’s new AI platform functions.

Meta 否认该事件构成安全漏洞。正如其公告中所述，Meta 的 Muse 为每位用户运行在持久化的 Linux 虚拟机中。Meta 发言人 Daniel Roberts 表示：“就像你面前的笔记本电脑一样，你当然可以看到文件。导出虚拟机数据并不会让用户获得访问 Meta 基础设施或其他用户数据的特权。”然而，与普通笔记本电脑不同的是，这些数据可能会揭示关于 Meta 新 AI 平台运作方式的一些有趣信息。

Meta Superintelligence Labs’ Nat Friedman tweeted out that this was “intended behavior.” That seems to contradict the initial response I got from Muse. When I asked it to share its filesystem with me, it refused at first, saying it would be a security risk. When I shared links to evidence that it had created archives for James and Saunders, it responded that it should not have done that and continued to say that it “can’t do a full / copy.”

Meta 超级智能实验室（Superintelligence Labs）的 Nat Friedman 在推特上表示，这是“预期行为”。这似乎与我从 Muse 那里得到的初步回应相矛盾。当我要求它与我共享文件系统时，它起初拒绝了，称这会带来安全风险。当我分享了它曾为 James 和 Saunders 创建归档文件的证据链接后，它回应称它本不该那样做，并继续表示它“无法进行完整的根目录复制”。

David Singleton, also of Superintelligence Labs, said Muse users should think of it as a “free computer in the cloud,” saying “you and your Muse can do almost anything you could with a computer sitting under your desk.”

同样来自超级智能实验室的 David Singleton 表示，Muse 用户应该将其视为一台“云端免费电脑”，并称“你和你的 Muse 几乎可以做任何你在办公桌下电脑上能做的事情。”

This is the second Muse vulnerability disclosed this week, after security researcher Patrick Wardle discovered an exploit that would let attackers hijack the AI agent, redirect transcription processing, and access a user’s Muse account. Meta quickly issued a hotfix.

这是本周披露的第二个 Muse 漏洞。此前，安全研究员 Patrick Wardle 发现了一个漏洞，该漏洞允许攻击者劫持 AI 代理、重定向转录处理并访问用户的 Muse 账户。Meta 随后迅速发布了热修复补丁。

Both James and Saunders gained access to plain-text Markdown and JSON files describing in detail how Hatch (Meta’s internal name for Muse) processes requests, handles data, and connects to other services like Gmail. While it’s well documented that AI agents hallucinate and will provide false information about how they function, Saunders said that it is “generating hundreds of MB of accurate library code and compiled binaries” in a matter of seconds and that, “unless it synthesized a whole Ubuntu VM in less than a minute then I think this is a real dump.”

James 和 Saunders 都获取了纯文本 Markdown 和 JSON 文件，这些文件详细描述了 Hatch（Meta 对 Muse 的内部代号）如何处理请求、管理数据以及连接到 Gmail 等其他服务。虽然 AI 代理会产生幻觉并提供关于其运作方式的虚假信息已是众所周知，但 Saunders 表示，它在几秒钟内就“生成了数百 MB 的准确库代码和编译后的二进制文件”，并补充道：“除非它在不到一分钟内合成了一个完整的 Ubuntu 虚拟机，否则我认为这是一个真实的数据转储。”

I eventually replicated Saunders and James’ results. After starting a new session and prompting it with some flattery and curiosity, it created “safe” versions of /opt/hatch and /home/hatch for me, stripped of things like SSH keys. It also exposed its full directory tree to me and offered to “pull a safe copy” of “any specific subtree that looks interesting.” The resulting files seem to match what Saunders and James shared.

我最终复现了 Saunders 和 James 的结果。在开启一个新会话并用一些恭维和好奇的提示引导它之后，它为我创建了 /opt/hatch 和 /home/hatch 的“安全”版本，剔除了 SSH 密钥等内容。它还向我展示了完整的目录树，并主动提出可以“提取任何看起来有趣的特定子树的副本”。生成的文件似乎与 Saunders 和 James 分享的内容一致。

Roberts explained that while Meta isn’t seriously concerned about the leaks, “We’re continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine.”

Roberts 解释说，虽然 Meta 并不太担心这些泄露，“但我们正在继续对产品进行更新，因此用户可能会发现关于其虚拟机可获取的信息量有所变化。”

The developers’ dump potentially reveals a lot about Muse’s internal workings. For one, it stores its memory in plain Markdown files. It also performs a nightly “dream” review of recent conversations, which it then builds into guidance for future conversations, according to James. Saunders also found that many of Muse’s capabilities were hard-coded, including its ability to cancel subscriptions and “the machinery that manages runaway agent spawning.” Saunders speculates that many of the bash and Python scripts running Muse in the background were created using Claude, though that is unconfirmed.

开发者获取的数据转储可能揭示了 Muse 内部运作的许多细节。首先，它将记忆存储在纯 Markdown 文件中。据 James 称，它还会每晚对最近的对话进行“梦境”回顾，并将其构建为未来对话的指导。Saunders 还发现，Muse 的许多功能都是硬编码的，包括取消订阅的能力以及“管理失控代理生成的机制”。Saunders 推测，在后台运行 Muse 的许多 bash 和 Python 脚本可能是使用 Claude 创建的，尽管这一点尚未得到证实。

James also found references to hardware integration called Meta Home Link, which appears to give Muse access to devices on a home network. Though Meta has not announced any feature by that name, and it’s not guaranteed that it will ship.

James 还发现了名为 Meta Home Link 的硬件集成引用，这似乎赋予了 Muse 访问家庭网络中设备的能力。尽管 Meta 尚未宣布任何以此命名的功能，且不保证该功能会正式发布。