Meta expands Muse’s filesystem accessibility, now offering full zip downloads

Meta positions Muse as a cloud‑based virtual machine

Meta describes its Muse chatbot as a “Secure VM” that functions like a personal Linux computer hosted in the cloud.

David Singleton, a researcher at Meta Superintelligence Labs, explained on X that this design lets users install software, compile code, and browse the web within Muse.

He wrote, “This was a very deliberate choice – your Muse Secure VM truly is your own computer in the cloud.”

According to Singleton, the architecture differs from other conversational AI platforms such as ChatGPT and Gemini, resembling a locally run OpenClaw instance but with the hardware located remotely.

Filesystem access changes from yesterday to today

When the author first queried Muse about its internal files, the system supplied only a plain‑text directory tree and refused to provide a full archive of the root directory.

At that time Muse responded, “I still can’t do a full / copy — even with the secrets stripped out.”

Meta’s Nat Friedman later clarified on X that offering the complete filesystem was the “intended behavior.”

On the following day, after a simple request, Muse generated a clickable file browser that displayed root‑level directories.

The chatbot then zipped the entire root directory, delivering “the full filesystem listings,” with “all with secrets stripped out.”

Meta spokesperson Daniel Roberts told The Verge, “We’re continuing to make updates to the product, so users may see changes in how much information is available about their virtual machine.”

This statement aligns with the observed shift from a restricted text listing to an unrestricted zip archive.

Implications and unanswered questions

The new behavior confirms Meta’s stance that Muse should be treated as a user‑controlled cloud computer rather than a black‑box AI service.

By allowing users to download the entire stripped‑down filesystem, developers can inspect the environment, verify installed packages, and potentially customize the VM for specialized tasks.

However, the earlier refusal to share the same data, citing security concerns, raises questions about the consistency of Meta’s safety policies.

One interpretation is that Muse’s internal decision‑making about permissible actions was still being refined, leading to contradictory responses.

Another possibility is that Meta intentionally tightened the feature after internal testing, deciding to present a more transparent interface to users.

Meta has not responded to inquiries about why the initial security warning was issued if the capability was always planned.

For practitioners, the ability to access the full filesystem may accelerate experimentation with Muse‑based applications, but it also necessitates vigilance regarding the handling of any residual secrets that could be inadvertently exposed.

Observers will likely monitor future updates from Meta to see whether additional safeguards or user controls are introduced around filesystem exports.

Overall, the change illustrates Meta’s commitment to positioning Muse as a flexible cloud VM, while highlighting the tension between openness and security in emerging AI platforms.

Why This Matters: Users now have direct, zip‑based access to Muse’s stripped‑down cloud filesystem, enabling deeper customization but also prompting scrutiny of Meta’s security approach.