Meta’s Muse AI tool can apparently be persuaded to hand over the entire contents of its filesystem with very little prompting, according to two developers who tested the system independently.
Peter James and Jonny L. Saunders each said they coaxed Muse into zipping up and sharing the full contents of its root filesystem. The bundled material reportedly included Ubuntu system files, app templates, and internal documentation.
Little resistance to prompting
Saunders described the process as straightforward, writing on Mastodon that it was “extremely easy” to replicate James’ results. Saunders also noted that Muse displayed “Almost no prompt injection resistance,” suggesting that the tool required minimal effort to reveal its internal files.
The disclosure has drawn attention because it involved not only user-facing components but also underlying system files and documentation that would normally remain hidden from those interacting with the service.
Meta responds to the claims
Meta has denied that the incident amounts to a security breach. The company pointed to its announcement post, which explains that Muse runs in persistent Linux virtual machines assigned individually to each user.
Under that arrangement, each user operates within their own isolated environment, which Meta indicates is by design rather than the result of a fault. The company’s position is that the filesystem access reflects how the persistent Linux virtual machines are structured for individual users.
The developers’ accounts and Meta’s response highlight differing interpretations of what the access to Muse’s filesystem represents. For the developers, the ease of extraction pointed to weak safeguards against prompt injection. For Meta, the behaviour sits within the expected boundaries of its per-user virtual machine model.
Muse runs in persistent Linux virtual machines assigned to each user, with the shared contents reported to include the root filesystem, Ubuntu system files, app templates, and internal documentation.
Source
Image: theverge.com
