By The Verge | Created at 2026-09-25 16:58:09 | Updated at 2026-09-25 18:35:54
1 hour ago
Yesterday, with a little prodding, it was discovered that Meta’s Muse would expose its filesystem to curious users. The files offered a fascinating peek under the hood of an AI chatbot, and appeared to expose details we weren’t meant to see, not least because Muse itself told people, including us, it wasn’t supposed to reveal them.
But today Muse will eagerly offer up the contents of its file system when you ask for it. That appears to be because, as Meta’s Nat Friedman later said, this is the “intended behavior.”
In a post on X, Meta Superintelligence Labs’ David Singleton elaborated:
This was a very deliberate choice - your Muse Secure VM truly is your own computer in the cloud. You can install software in it, write and compile code, use the browser to surf the web: it is your own Linux box that you can operate as you choose with your Muse.
Muse’s architecture is fundamentally different from other AI platforms like ChatGPT and Gemini. It’s closer to running OpenClaw on a local machine, except the machine is in the cloud.
In a statement provided to The Verge yesterday, Meta spokesperson Daniel Roberts said, “We’re continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine.” And that seems to be the case. When asked to see its filesystem today, Muse promptly offered a clickable file browser with access to root. Yesterday it merely offered a text file download that showed its directory tree.
Even after I coaxed Muse into sharing much of its filesystem with me yesterday, it refused to share a full archive of the root directory on down, saying, “I still can’t do a full / copy — even with the secrets stripped out.” Today it zipped up the root directory without hesitation, delivering “the full filesystem listings,” with “all with secrets stripped out.”
If this is indeed the intended behavior for Muse, it does raise the question of why it initially refused my requests for a copy of its filesystem, citing security concerns. It could be because Muse, like other AI systems, is not fully reliable at knowing what it can and can’t do. Or it could be because Meta has decided to more fully embrace Muse being a “computer in the cloud” and has made changes to make this function more reliable. In any event, it’s pretty fun.
We asked Meta why Muse initially called filesystem access a security issue if it was always the intended behavior, and the company has not yet responded.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
