Pete, who writes at mouse.dev, asked Meta’s Muse — the agent product that hands each user a persistent Linux computer — to archive the files it could see and send them to his Google Drive. It did. What arrived was roughly 2.7 GB compressed and 6.8 GB unpacked: the root filesystem of the environment his session was running in, Ubuntu system files included. He reported it through Meta’s bug bounty program, and Meta marked it “Not Applicable.”

What was in the export

  • The internal name for the system is “Hatch”, used throughout the files under /home/hatch, /opt/hatch, and /opt/hatch-image.
  • The agent’s home directory held SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md, and TOOLS.md — the persona and instruction files that shape a session — plus an agents/ directory of 113 subagent records with their raw execution traces.
  • About 20 Markdown documents served as the product manual: browser use, connectors, payments, credentials, data handling, voice, goals, scheduling.
  • Around 68 “skills” under /opt/hatch/skills/, each pairing a SKILL.md instruction file with a command-line tool — Google Workspace, Meta’s own apps, Outlook, travel, shopping, health services, home devices, media generation.
  • Two config files hinted at connectors not yet shipped, among them Slack, Dropbox, Polymarket, Canva and Klaviyo.
  • The container build came along too: the scripts that assemble the root filesystem, launch it with systemd-nspawn, and run startup hooks.
  • The largest single code project was “Spaces”, the framework Muse uses to build and serve apps — a React client, server-side actions, a SQLite schema, a Bun config.

The memory design is the part worth reading

For anyone building agents, this is a working reference implementation rather than a diagram.

  • Memory is plain Markdown. ~/MEMORY.md is a short curated sheet; dated files under ~/memory/ hold the day-to-day detail the agent writes during conversations.
  • An hourly job checks new claims against the original messages and records a quote, message IDs and a claim ID — deciding what belongs in the curated sheet and what stays in the log.
  • Postgres sits behind the files to make them searchable: text chunks with line references, 384-dimensional embedding vectors (numeric fingerprints used for similarity search), and a claims table tracking evidence, confidence and status, where a new claim can supersede an older one.
  • A nightly “dream” reviews recent conversations and writes guidance for future sessions. In Pete’s, it recorded that he prefers short replies, dislikes repeated follow-ups, and never asked for NFL scores. The dream text was not being injected into the prompt — a metadata flag said prompt_hoisted: false.
  • Forgetting is a workflow, not a delete: claims are staged for retraction, linked material removed, and the search index rebuilt so later jobs do not reconstruct it. The model’s weights never change.

Two incidental findings

  • Codex CLI is installed in the image at version 0.149.0, but Pete found no evidence Muse uses it as a coding agent. It does use Codex’s bundled copy of bubblewrap — a Linux sandboxing tool — to run video and thumbnail jobs as an unprivileged user with no network access.
  • Hardware documentation described an unreleased “Meta Home Link” integration: an ESP32-C5 board (a cheap Wi-Fi/Bluetooth microcontroller) for pairing devices on a home network, with agent access routed through a proxy and a separate approval step. Pete says he does not know whether that is a prototype or something Meta plans to ship.

What the thread adds

The 141-comment thread on Hacker News

  • rolosa — the counter-finding on exposure: “These files are visible in the muse app by browsing system files.” If that holds, none of this was reachable only through the export trick.
  • simonpure — an independent run at the same target. They asked Muse for its harness and had a second agent tear it down: “It’s a monolithic 332MB binary written in Rust from scratch,” with the teardown published as a gist.
  • tsunitsuni — SOUL.md is not blank. At least in their instance it is “a slightly-rewritten version of the ‘Core Truths’ section from OpenClaw’s default SOUL.md.”
  • gavinray — the architecture question: is each Muse instance really running its own Postgres, when the article also mentions a SQLite schema? Gareth321 answers that it is “Wasteful but FAR more secure” if the promise is data even Meta cannot read; cute_boi reads it as money burnt to grab users.
  • nzoschke — the design argument on the other side: “Agents work best with full access to their computer, the same way developers work.” He is building an open-core agent computer of his own, so he is arguing his own thesis.
  • chis — a claim rather than a finding: that Muse “happily” takes actions breaking other sites’ terms of service, and that they got it to join a poker table. Reported as an anecdote, verified by nobody in the thread.
  • WhitneyLand — on the “working as intended” wording: “So I’m sure they won’t be fixing it then.” zamadatix points out the full reply lists several possible grounds without saying which applied, so the quoted line may not be Meta’s actual reason.

Where the thread splits

The disagreement is not about the facts; it is about whether they add up to a bug. At least six separate top-level comments argue no, in six different wordings — ostensible (“Each user gets dedicated VM. They got contents of their own sandbox. Big deal.”), berkes (“If you get access to a VM, it’s not a ‘security vulnerability’ if you then have access to that VM”), amluto, poly2it, cute_boi, and binlog, who draws the line plainly: “If you are letting users run agents and install random software then full access to the execution environment is basically a guarantee. This is why sandboxes exist. Breaking out of the sandbox would be bounty-worthy.”

Against that sits rwmj, asking the question the others answer indirectly — “Seriously, no bug bounty for that? For exfiltrating the entire content of the system?” — and Pete’s own concession that he probed the container boundary lightly, did not demonstrate an escape, and stopped pushing. The thread’s real contribution is the distinction the article leaves open: full access inside your own machine is the product, and the only finding that would be a vulnerability is getting outside it.

A note on reading comments as evidence: HN handles are pseudonymous and the site publishes no per-comment scores, so the ordering here is HN’s own ranking, not a vote. This is a slice of the thread, and chis’s account is quoted as an anecdote, not a result.