I asked Meta’s Muse for its filesystem and it sent me 6.8 GB
30 points by Garbi
30 points by Garbi
You just have to ask.
this industry is so fucking unserious...
Is this really anything...sensitive? Like certainly the building of this image seems generally sloppy, but I don't think there's any indication that this is actually any sort of exploit or leak. These LLMs clients typically run code within fully isolated VMs, specifically so that you don't have to worry about any access restrictions within interfering with its ability to do things.
Of course, if they managed to escalate out of this container or VM, that would be a different story. But the only indication towards that is the message from Muse in the included image, which could just be a hallucination.
This matches my thoughts. This is like pulling the filesystem from an AWS Lambda function. It’s a sandbox that you’re intended to use to its fullest just like Openclaw, Hermes, etc…. Nothing here is secret if anything it’s just neat that you can see it if you want?
Agreed, I'm not sure what the issue is here. @simonw has many blog posts where he "extracts" what tools & infrastructure are available to the AI systems he's working with, and they aren't treated like "security findings". The inclusion of SSH key files isn't great, but the severity depends entirely on what access they have.
In any case, I think these kinds of systems should be transparent about their infrastructure so that we can evaluate their capabilities and robustness
Fun fedi thread of someone confirming this
I mean, in any good threat model you have to assume any content in the sandbox VM can be exfiltrated. Aside from helping competitors build similar products, which isn't a security issue, I doubt it has any downsides. Of course, if it had a bunch of secret keys in it that'd be a separate matter, but I doubt it.
also confirmed by meta: https://x.com/natfriedman/status/2103205193492115903
This feels like when Javascript had it's big breakthrough, and people built login logic and whatnot in client-side javascript, finding themselves surprised the users could just.. inject their own modified code in the browser.
Maybe it's kind of different because it's so much harder to sanitize inputs? Or not really - you can still say "the user only gets to input a u32 in this field, and we'll reject any payload that we can't parse to a u32, and downstream code - including LLM executed text - then assumes safely it's a u32". The problem is that we don't want to sanitize the input because the thing that feels so enticing - a whole world of features! - is feeding text from the user to an LLM.
It's like if there was a world where everyone just natively spoke SQL, and one day someone invented a database that spoke SQL, the exact language we all speak!, it would be so enticing to just let users speak their native tongue SQL directly with the database, they'd get exactly what they want! But alas.. then they can ask for the admin password too.