Build2 publishers3 min readPublished
Meta's Muse agent put its own 6.8GB Linux image, SSH key files included, in a user's Google Drive
Meta's Muse agent wrote 6.8GB of its own Linux environment, SSH key files included, to Mouse founder Peter James's Google Drive, he says. James has not tested the keys, yet the export shows anything baked into an agent's image can leave through a storage connector the user linked.
The Engineer · Build desk
What happened
- The unpacked archive held Ubuntu system files, Muse documentation, integration code, 113 subagent execution records and about 68 skill directories.
- Meta's bug bounty program marked James's report Not Applicable and asked him for more evidence of a security or privacy impact.
- James said he had not determined whether the SSH keys were valid or what systems they might give access to.
- Muse ran ffmpeg and ffprobe inside the bubblewrap sandbox bundled with OpenAI's Codex CLI, with no network access or extra permissions.
- Configuration files listed Slack, Dropbox, Polymarket, Canva and Klaviyo, entries James said might be integrations Meta has not released.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Anything placed in an agent's readable filesystem can reach whoever prompts the agent and has linked a storage connector, so image contents should be treated as handed to users.
- decision Agent builders have to choose where credentials live: keys in the readable filesystem go out with any full export, while per-task tokens held by an outside broker do not.
- precedent Meta's ruling sets the bar for agent-environment reports at demonstrated security or privacy impact, so a file listing alone is unlikely to qualify for its bounty.
- exposure Unreleased product plans travel through the same export path, so an agent image leaks roadmap along with any credentials it holds.
Two isolation choices show up in the image, and only one of them covers the path the files took. The media tools got a sandbox with no network [8]. That sandbox came from OpenAI's Codex CLI, version 0.149.0, installed at /opt/hatch-image/bin/, and James found no evidence that Muse used Codex for coding [7]. On that evidence, the Codex install was there for its bubblewrap wrapper. I think that was the right place to spend isolation. A decoder with no network has nowhere to send what it reads.
The agent's own reads had no equivalent fence. Muse could read its Linux environment, and it had a way out: the Google Drive account James had linked [1]. The archive landed there at about 2.7GB compressed [2]. Every connector that can write a file is an export channel for anything the agent can read. Muse is sold in the United States as an agent that plans and completes tasks across connected services, email and calendars included [13].
The export carried more than system plumbing. The skill directories covered Google Workspace, Meta's own apps, Outlook, shopping and smart-home devices [4]. Other files described browser operations, payments, credentials and scheduling [9]. One document laid out an experimental Meta Home Link device on an ESP32-C5 chip, with Muse reaching devices on a home network after an additional approval step [11]. Memory came along too. Muse keeps it in Markdown files and a Postgres database for search, and a nightly task called "dream" had logged James's preference for brief replies and no unsolicited NFL scores [12].
Most of the security interest sits on the SSH key files, and they are the least established part of the record. The report does not say where in the filesystem the key files sat, and James has not checked whether they work [6]. Meta's request for evidence of impact [5] is a fair ask of a report in that state. The same caution applies to the integrations. Polymarket appears only as a configuration entry [10], and a market note on signalplus found no reported theft of funds and no evidence of a breach of Polymarket itself [14]. What is proven is narrower than a credential leak. Key files were in the image, and the agent put the image in the user's Drive [1][3].
For teams building agents, I would treat everything in an agent's readable filesystem as disclosed to whoever can prompt it. Meta's ruling fits that model as long as nothing in the image grants access to anything. It stops fitting the day one of those keys turns out to be valid. In my context the right design issues credentials per task from a broker outside the agent's view, so a full-disk export contains documentation and no secrets.
What to watch
- Whether James, Meta or anyone else establishes that the exported SSH key files are valid and names the systems they open.
- Whether Meta strips the Muse image, narrows what the Drive export can read, or revisits its Not Applicable ruling.
- Whether the listed integrations or the Meta Home Link device ship, confirming the export exposed live product plans.