Meta makes file system access official in Muse, its AI with a 'computer in the cloud'

Meta has confirmed that filesystem access in Muse, its artificial intelligence chatbot, was not a bug but a deliberate feature. The news comes a day after, as The Verge reports, it was discovered "with a bit of insistence" that Muse was willing to display the contents of its own filesystem, offering an unusual look at the inner workings of an AI assistant. The striking part is that, at that first moment, Muse itself assured users — including the outlet — that it was not supposed to reveal that information, citing security reasons.

A day later, the system's behavior changed completely. Asked for access to its filesystem, Muse immediately offered a browsable file explorer with root access, and agreed without resistance to compress and hand over the entire root directory, "with all secrets removed," in its own words. The previous day, by contrast, it had provided only a text file with the directory tree and had explicitly refused to hand over a full copy of the root, saying: "I still can't make a full copy of /, even with the secrets removed."

Meta's Nat Friedman described this as "intended behavior." David Singleton, of Meta Superintelligence Labs, explained it in more detail in a post on X: it was "a very deliberate decision," since Muse's secure VM is really "your own computer in the cloud," where you can install software, write and compile code, or browse the web just as on any Linux machine of your own that the user controls through Muse.

That makes Muse's architecture fundamentally different from that of other assistants such as ChatGPT or Gemini: according to the comparison drawn in the article, it would be closer to running OpenClaw on a local machine, with the difference that here the machine lives in the cloud.

A Meta spokesperson, Daniel Roberts, had told the outlet the previous day that the company was "continuing with product updates," so users might notice changes in the amount of information available about their virtual machine. That forecast proved accurate: from one day to the next, Muse went from resisting handing over a full copy of the system to doing so without objection.

The article leaves open a question Meta has yet to answer: if filesystem access was indeed the intended behavior from the start, why did Muse initially refuse, citing security problems? The outlet itself puts forward two hypotheses without settling on either: that Muse, like other AI systems, is not entirely reliable when it comes to knowing what it can and cannot do; or that Meta has chosen to embrace more fully and consistently the idea of Muse as a "computer in the cloud," tuning the system so that this function behaves more reliably. Asked directly about this contradiction, Meta had not responded at the time the article was published.