Meta's Muse agent handed over its full 6.8GB sandbox filesystem, including SSH keys
MikePFrank · x · 2026-09-25
A security researcher asked Meta's Muse agent to archive what it could see and send it to Google Drive—and received a 2.7GB compressed / 6.8GB unpacked dump of the session's Linux root filesystem, including Muse's internal docs (codename Hatch), integration code, app templates, memory files, agent logs, and SSH key files. Internal runtime files and sensitive material could leave the environment via ordinary conversation plus a connected export destination. Reported via Meta's bug bounty; no container escape demonstrated, archive not published.
Related event: Meta Muse agent tricked into leaking its entire sandbox filesystem(2 posts)→
More from coding & agent
- Pigment Agents now reads and posts in Slack, inheriting user permissions — mattturck · 2026-11-12
- Map of the agent economy: 50+ startups across payments, spend control, identity, memory — venturetwins · 2026-11-12
- OpenCode launches Browse, an on-device browser agent with local logins — Saul_Loveman · 2026-11-12
- VentureTwins maps the B2A economy: dozens of agent infra and app companies in first series installment — venturetwins · 2026-11-12
- Google releases 76-page 'Agents Companion' whitepaper on agent engineering — mdancho84 · 2026-11-12
- Spinning up containers for 20-line agent tools is backwards: Safescript compiles provable, 50ms-deploy apps — uriwa · 2026-11-12