Sent you a dm - bugbounty.meta.com is our responsible disclosure program. Appreciate your interest!

This is rubbish - we didn’t declare any such thing.

hey there, reaching out from the Muse team. We'd love to learn more about your experience. Could you dm me to chat?

We built a system file explorer right into the mobile app:

I’ve seen a couple of posts about this so wanted to demystify. Today, every Muse user gets a free computer in the cloud. It's a real computer, and we’ve designed the security architecture of the Muse Secure VM carefully so you and your Muse can do almost anything you could with a computer sitting under your desk while keeping you and the system safe from threats like prompt injection. We wrote about this at length in our security blog post – security.muse.ai. Activity in the “runtime cell”, which you share with your Muse is unfettered, but sensitive actions are all overseen by the Sentinel, which runs outside of that cell. Similarly, all sensitive secrets - like the passwords you enter into Muse’s secure credential storage - are also stored outside the runtime cell. The runtime cell gets its own root filesystem (including a full Ubuntu linux image) separate from the host filesystem where your other more sensitive data lives. Because it is isolated from the sensitive stuff that runs on the same box, this means that we can, and do, offer users full visibility and control over the files in the runtime cell. Just as you can when you install Linux on your home computer, you can poke around and see all the files that make the system work - both debian system files and the binaries and data files that implement the parts of Muse which run in the runtime cell. This was a very deliberate choice - your Muse Secure VM truly is your own computer in the cloud. You can install software in it, write and compile code, use the browser to surf the web: it is your own Linux box that you can operate as you choose with your Muse. Poking around in this computer doesn't give you any privileged access to Meta infrastructure, or to other people's data If I may geek out a little here for a second… As a kid I loved to take things apart to see how they worked. As a teenager I got into computers and soon found myself drawn to C:\WINDOWS\SYSTEM and the system registry, later Slackware’s /dev/, /proc/ etc – I could see how the system was laid out and as I explored what DLL files and .so files actually did, I gradually became able to meld the computer to my own will. We’re really proud to be able to put a real computer in millions of people’s hands with a similar level of transparency. We built a file explorer right into the Library tab of the UI. We want you to be able to see the markdown files Muse writes while it thinks about how to serve you better, and explore the internals of the system if you’d like to. So, when you ask your Muse to show you its entire filesystem, and receive gigabytes of files you’re seeing the full contents of the runtime cell. It’s yours to explore and enjoy! If you’re not a geek like me, or simply want to download the data that you personally have created directly with your Muse, we added a feature for that too in Settings > Data controls > Download your agent data.

Yes! You can read all the files in the runtime cell - it's your computer 🤓.

We haven't nerf'd anything so would love look into this for you - pls dm me and we'll take a 👀

Excited to be the first to bring the music to @Muse 🎧

you gave your Muse a look. now give it a voice

I love cooking, so being able to talk to my Muse to go from recipe idea -> shopping list -> ingredients at my door has my mouth watering already!

Here at Expedia, we love planning trips. Soon, your personal AI agent will too. We're joining @Muse: tell it where you're headed and it can work with Expedia to sort your hotels, and everything in between.

👯

We appreciate this report and have issued a hotfix to the Muse Mac app. This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user’s machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low. Nonetheless, we have issued a hotfix to the app to address the issue. We take every report of a possible security problem very seriously, including those that arrive as published exploit code (like this one). We strive to be extremely transparent about privacy and security in Muse as we know this is important to maintain your trust. Therefore, here’s a little more detail on this issue: - Muse's dictation is powered by a server-side speech model. The app shipped with an internal setting that allows the endpoint used by this feature to be redirected to a different URL, which is useful during debugging and development. - The setting lives in the app's local preferences, which macOS allows any program running under your user account to modify. Changing this requires malicious code already running on your Mac. This is not remotely exploitable, and it does not involve Muse's servers or the Secure VM that isolates agent tasks. - Overriding this setting would let an attacker proxy audio dictation requests and capture the access tokens the Muse app uses to drive the Muse agent – expanding malware already present on your computer into the Muse agent. Our hotfix removes the endpoint setting from production builds entirely, which closes this vulnerability. - We are grateful for the work of the security research community and potential security issues can be responsibly disclosed via our bug bounty program, which pays up to $300,000 for exactly this class of finding. bugbounty.meta.com/

We are excited to announce we are partnering deeply with Muse to enable agentic checkout with Shop Pay on all Shopify stores, offering people an easy and delightful way to shop and check out with Muse.

@Muse handles this thoughtfully - our email connector filters out one-time tokens, password reset links, and login magic links via both deterministic filters and a classifier model. You can read more at security.muse.ai

The action button integration is absolutely the fastest way to ask your @Muse to do stuff for you on iOS - including directly from the lock screen. It's sick!

I've been using the @Muse app on my Mac all day, every day for a while. There are four things it does that I really love: 1/ Quick access to my Muse when I'm working in any other app: ⌥–Space and Octavian appears, ready to help. 2/ Fast SOTA dictation into any app on my computer by holding fn (these shortcuts are configurable, ofc). 3/ The Muse app works with the messaging apps on my computer and helps me keep up. Sorry if I ghosted you before; I can never keep on top of my messages. Muse is already making me a better texter. 4/ My Muse has a little bot status pill that hangs out in the corner and tells me what Octavian is up to on my behalf all day long. What are you using the Mac app for?

🧐 Eagle eyes, @jmduke - thanks for the report. We've fixed this now :-)

The power and flexibility of being able to integrate with *any* API service you care about means the ceiling of @Muse capabilities is very very high. Which services have you built custom connectors for in Muse and what are you using them for?

@Muse secure VM's Sentinel and human-in-the-loop system gives you visibility and control over all sensitive actions your agent can take. Custom connectors fit right into this system. You’ll get a human-in-the-loop approval for custom connector requests.