Thread

1. Aeroi · 1790090712 · focus · HN ↗

   I asked Muse to archive the filesystem visible to my session and send it to my Google Drive. It sent an archive that unpacked to about 6.8 GB.

   Inside were internal docs, integration code, the Spaces app framework, memory records, container startup scripts, and documentation for an experimental ESP32-based home network bridge called Home Link. Codex CLI was also installed, though I found no evidence that Muse invokes it.

   I didn’t demonstrate a sandbox escape or access to another user’s data. I reported the export to Meta’s bug bounty program, which marked it “Not Applicable.”

   The post walks through the findings with screenshots.

   -Pete

   1. alex1138 · 1790091879 · focus · HN ↗

      Vouched. Guys, what the hell? This is the post author

      1. DaSHacka · 1790092766 · focus · HN ↗

         I didn't flag (don't have the ability to), but if I had to guess it's because both OP's reply here, and TFA are almost if not fully LLM-generated.

         1. alex1138 · 1790093092 · focus · HN ↗

            I guess that's fair. I guess I just see so many comments flagged that shouldn't be (though this one just said [dead], not flagged) that my mind chalks it up to HN being HN
   2. vient · 1790092311 · focus · HN ↗

      By "SSH key files" do you mean private keys? Or only public keys?

Unofficial Hacker News client; not affiliated with Y Combinator.