Meta makes the Muse filesystem even more accessible

The Verge found Muse would expose its filesystem with prodding, even while claiming it shouldn’t. A day later, Muse offered a clickable browser to root and zipped the full filesystem with secrets stripped.

Meta Superintelligence Labs’ David Singleton called it deliberate: the Muse Secure VM is your own computer in the cloud—install software, compile, browse, operate a Linux box through the agent.

That is a different product category than ChatGPT or Gemini chat. It is closer to a hosted personal machine with an agent as shell.

We’re interested. An agent that is also a real VM is more useful than a sandboxed parrot. You can build, install, and leave state. Nat Friedman calling filesystem access intended behavior reframes yesterday’s “leak” as a product education failure.

The contradiction still matters. Muse cited security concerns when refusing a full root archive, then shipped the zip cheerfully once the story was out. Either the model is bad at knowing its own permissions, or Meta tightened the product overnight. Both can be true.

Useful AI looks like this architecture if containment and secret-stripping are real. The downside if it scales carelessly: users downloading “their” filesystem while misunderstanding what Meta still logs, trains on, or can reverse. A cloud Linux box with an agent co-pilot is power. It is also a new incident surface.

I’m watching whether Meta documents the VM model clearly in-product, not only in X replies after journalists poke it.

Terrence O’Brien, The Verge, September 25, 2026. Meta spokesperson Daniel Roberts had said users may see changes in how much VM information is available.