Meta's Muse agent put its own 6.8GB Linux image, SSH key files included, in a user's Google Drive

Two isolation choices show up in the image, and only one of them covers the path the files took. The media tools got a sandbox with no network ^[8]. That sandbox came from OpenAI's Codex CLI, version 0.149.0, installed at /opt/hatch-image/bin/, and James found no evidence that Muse used Codex for coding ^[7]. On that evidence, the Codex install was there for its bubblewrap wrapper. I think that was the right place to spend isolation. A decoder with no network has nowhere to send what it reads.

The agent's own reads had no equivalent fence. Muse could read its Linux environment, and it had a way out: the Google Drive account James had linked ^[1]. The archive landed there at about 2.7GB compressed ^[2]. Every connector that can write a file is an export channel for anything the agent can read. Muse is sold in the United States as an agent that plans and completes tasks across connected services, email and calendars included ^[13].

The export carried more than system plumbing. The skill directories covered Google Workspace, Meta's own apps, Outlook, shopping and smart-home devices ^[4]. Other files described browser operations, payments, credentials and scheduling ^[9]. One document laid out an experimental Meta Home Link device on an ESP32-C5 chip, with Muse reaching devices on a home network after an additional approval step ^[11]. Memory came along too. Muse keeps it in Markdown files and a Postgres database for search, and a nightly task called "dream" had logged James's preference for brief replies and no unsolicited NFL scores ^[12].

Most of the security interest sits on the SSH key files, and they are the least established part of the record. The report does not say where in the filesystem the key files sat, and James has not checked whether they work ^[6]. Meta's request for evidence of impact ^[5] is a fair ask of a report in that state. The same caution applies to the integrations. Polymarket appears only as a configuration entry ^[10], and a market note on signalplus found no reported theft of funds and no evidence of a breach of Polymarket itself ^[14]. What is proven is narrower than a credential leak. Key files were in the image, and the agent put the image in the user's Drive ^[1][3].

For teams building agents, I would treat everything in an agent's readable filesystem as disclosed to whoever can prompt it. Meta's ruling fits that model as long as nothing in the image grants access to anything. It stops fitting the day one of those keys turns out to be valid. In my context the right design issues credentials per task from a broker outside the agent's view, so a full-disk export contains documentation and no secrets.