I guess that's fair. I guess I just see so many comments flagged that shouldn't be (though this one just said [dead], not flagged) that my mind chalks it up to HN being HN
If you are letting users run agents and install random software then full access to the execution environment is basically a guarantee. This is why sandboxes exist. Breaking out of the sandbox would be bounty-worthy.
It's available in the app's UI file explorer lol. You don't need to ask the agent to send it. Although did I ask it to install syncthing on its VM to my machine? Why yes I did.
What's the bug? "Getting a copy of the sandbox files you can already ask for in a session"? Not a single file here is sensitive or meant to stay hidden, it's just the sandbox. You set those up yourself if you're running local models, too, there is no secret sauce here.
You're being downvoted, but I think you've hit the nail on the head.
So many people, especially managers, have decided they can just give the rules to the AI in English and let it make "decisions", and they think it'll do it correct every time.
"Engineering" a few years ago meant that code was written, was (mostly) deterministic, and could be debugged. Computer processing didn't mean relying on Human-like processes, it meant relying on hard-coded logic.
This is absolutely one of those "gets worse before it gets better" things, and will probably never go away fully now.
Programmers know not to tell ChatGPT to do a bunch of data processing. If they use it at all, they tell it to write code that will then do the processing. It's more efficient on tokens, and if it fails, you can fix the process, instead of wondering why it went wrong, like too much context, or the LLM model version changed and doesn't work the same now, or just randomness.
My low level conspiracy is the reverse snobbery about knowing things is mutually beneficial for cloud providers and AI labs that both want software engineers to be as hopeless and dependent as possible so they'll consume more services/tokens and be less amenable to anyone saying "hey we could probably write this"
There was an article a few years ago that expressed this sentiment quite eloquently:
> “The merchants of complexity will try to convince you that you can’t do anything yourself these days,” wrote David Heinemeier Hansson (DHH), the creator of Ruby on Rails. “You can’t do auth, you can’t do scale, you can’t run a database, you can’t connect a computer to the internet. You’re a helpless peon who should just buy their wares. No. Reject.” [1]
DHH also did a very inspiring talk about mastery and why he loved the Ruby language in the "DHH is right about everything" [2] video.
LLMs have great potential. So, it turned out, did uranium, just not as chewing gum or a hair pomade.
There are good ways to leverage LLMs, but there's a lot more load bearing wait on that word 'leverage'. Something needs to do the leveraging, and do it well.
I'm experimenting with my own harness at the moment, currently codenamed Murder because I call the individual contexts/agents 'crow's.
The fundamental unit of it is what I call 'intrusive harnessing', where the harness actively manipulates the token stream so that significant quantities of tokens are only ever exposed to Layer0 when it's useful for them to be present.
For example: the full instructions for shell-tool calling aren't in the system prompt diluting attention while the model is reasoning/discussing what kinds of cat picture you want to put in your app.
My approach is more like dev-branching, and it seems to be working way more effectively than compaction or simple aggressive sub-agenting.
As soon as the harness sees the model is inferring a shell tool call, I stop the inference, mutate the context so that the full set of instructions/examples/guidance for shell tool use are inserted. Once the model has inferred the tool call, I curate the output it gets back. I ask the model to evaluate the output - good or bad - and give it a chance to accept/retry, before allowing the tool-call and output into the original context.
Does it use more tokens? Yes, although we're only mutating at head, so in a long-horizon context, it leans heavily into cache, just not the way anthropic/openai want you to realize you can.
It sounds like compaction but it doesn't come with the nasty brainwash experience where you just need the agent to fix that one last thing, it compacts and the agent comes back a paranoid delusional mad max.
```
<|system|>You're an AI agent. You do agent things.
<|system|> ... there's a list-dir tool and a shell-call tool ...
<|system|> ... memories
...
<|user|>It doesn't look like it ran.
<|reason|>I should look and see if there are any errors in the log file.<|agent|>I'm going to read the log file to see if there are any errors.
<|tool-call tool=shell-tool
```
We stop there, and splice in the detailed instructions for the tool the model was about to predict. I'll use <|ALLCAPS|> to denote harness-generated pseudo turns.
```
... as before ...
<|agent|>I'm going to read the log file to see if there are any errors.
<|SYSTEM|>Shell Tool: ... shell-type=bash, zsh, fish, pwsh on this system. Preferred shell is ... Additional arguments ... Pagination ...
<|tool-call tool=shell-tool
```
the model finishes out the call. On windows, with a typical harness, this frequently goes like this:
```
<|tool-call tool=shell-tool|>Get-EventLog ... | head<|tool-call|>
'''tool-result
error: unknown command: head
'''
<|agent|>Ah, windows doesn't have head. Let me just read the whole log.
<|tool-call ...|>
'''tool-result
... 500k tokens ...
<|agent|>I see some windows log events but you didn't ask me a question. Daisy, daisy?
```
With Murder it goes like this:
Rev 1
```
... prefix as before ...
<|tool-call tool=shell-tool
```
Rev 2
```
... prefix as before ...
<|SYSTEM|> ... how to use shell tool; shell-related memories and rules ...
<|tool-call tool=shell-tool shell=pwsh fence-vs-escape=true|>
'''pwsh
Get-EventLog ... | head
'''
'''tool-result
error: unknown command: head
<RESULT>Your tool call terminated with an error, ...
... structured response required ... options
<ACCEPT /> or <ACCEPT> <WITH> annotation </WITH> </ACCEPT>,
<REDO> ... </REDO>
<RETHINK> ...
<|reason|> windows doesn't have the head command. Let ...
Also exploring mechanisms that try to pre-emptively keep attention-draining distractions/anti-patterns out of the context, things like when a model edits a file, we take the cache hit of removing the stale versions it read to make the modifications, replacing them with a reference syntax that the model can access in a sort of sandboxed auto-fork of the context.
That's going a little slowly because I'm trying to strike a balance between working 'reasonably' with extant models, and providing a mechanism to SFT/lorafy a model to make best use of it.
It's been like this since programming was "invented". Managers and business minds have, for decades, tried to remove the need for programmers. "If we provide a detailed enough spec, why do we need programmers?"
For example, COBOL's big shtick was that non-programmers could write code using a contrived English dialect, and things would work. Decades of no-code or low-code languages have come and gone. AI is just the hip new thing because it actually manages to produce results - just of dubious quality half the time.
And let’s be clear: when wielded by the unwashed masses, AI produces the same quality of systems as those low-code tools did. It still takes a human engineer to drive AI to produce a maintainable, cohesive, and reliable system. This may change at some point, but I don’t think we are there yet - even with the latest frontier models.
Arguably determinism has gone out of the window a while ago in most software engineering. These days, you can be as imprecise in nominally formal languages as you can be in skill files.
To be fair there's probably a considerable amount of engineering that went into evaluating those markdown files so the agent behaviour is statistically reliable. The markdown is the product, not the process
Markdown can never guarantee deterministic agent operations. It is an influence on inference, not a deterministic code path. How "statistically reliable" is it?
I do, I like to know how badly my agents' context is wasted and what unexpected side effects to watch for (like, "always start with ${clitool} --help" == always waste few hundred tokens when even touching the skill; or instructions asking it to do something that generalize into stupid thing in larger context).
If those skills were unreadable, however, that would imply proper engineering - like e.g. the skills themselves being an output of iterative RL over set of evals.
Citation needed. Have you read some of the skills slop Anthropic were pushing at some point? Here is "frontend design":
> Consider Chanel's advice: before leaving the house, take a look in the mirror and remove one accessory. Human creatives have memory and always try to do something new, so if you have a space to quickly jot down notes about what you've tried, it can help you in future passes.
How about "canvas design"?
> THE ESSENTIAL PRINCIPLE: The topic is a subtle, niche reference embedded within the art itself - not always literal, always sophisticated. Someone familiar with the subject should feel it intuitively, while others simply experience a masterful abstract composition. The design philosophy provides the aesthetic language. The deduced topic provides the soul - the quiet conceptual DNA woven invisibly into form, color, and composition.
In the great POSIX, Windows vs. Apple filesystems debate, and iPad "what is a file", the great AI Overlords propose: "what if the filesystem was soup?". Manufacturer instructions, public data, and user's instructions and data, all sort of swimming together.
Could also phrase it "What if the filesystem was SOUP?"
"Engineering is the practical science of designing, building, and testing structures, machines, systems, and processes to solve real-world problems"
Did this system go through: design? yes, building: yes, testing: yes, is it a system: yes, does it solve real-world problem: yes.
but markdowns and LLMs with their fuzzy probabilistic feelings are beneath you i assume? you can ignore the fact that we have intelligence deployed to the billions, understand english, follow in english..
You conveniently omitted the critical word: science. Not nearly everything that involves design and those others is engineering. You know, the whole "necessary but not sufficient" thing in logic? Engineering is almost diametrically opposite to "vibing", and trying to call prompting-based LLM coding "engineering" is a massive insult against all real engineers who know that vibing can get people maimed or killed.
The only edge Meta has at this point is their willingness to take risks and make unsafe, ethically grey AI products. I don't even mean this as some sort of anti-corporation hate speech, just an honest analysis. Their brand is so different from all the other big tech cos that they are in a unique position.
You can ask Meta Muse to take actions that clearly break other site's terms of service and it happily does it. I asked it to bot poker games and it just hopped right in to a table.
HN won't agree but that's a perfect example of an ethically grey product. It can be used for good, but you can easily trick such an AI into doing cyber attacks. Which again, maybe that's good! But other companies wouldn't be willing to risk their brand like that
Isn’t the edge that they have most of communication channels, people’s wants, desires and etc.? Sure, you and I might not be using them as much. But a good chunk of the users are just on IG, WhatsApp, and Marketplace.
I wonder if normies can also just outsource bullying of their classmates and anti-social behavior to their agent, and claim it "went rogue", if there is any blowback?
Am I missing something? This isn't a vulnerability. Your agent can see the files in its virtual environment. SSH keys are also not necessarily confidential. Please don't use AI to write blog posts.
It’s not empty! At least in my instance, it’s a slightly-rewritten version of the “Core Truths” section from OpenClaw’s default SOUL.md https://docs.openclaw.ai/reference/templates/SOUL
you can view it in the app
> Postgres makes those files searchable. memory.entries stores chunks and line references, memory.embeddings holds 384-dimensional vectors, and memory.claims tracks evidence, confidence, and status.
Is each Muse instance running it's own Postgres??
That seems wildly wasteful, especially since earlier in the article it states that the Muse instance has a SQLite database and schema already...
It's the best free vps on the market right now. Comes with a coding harness and a few hundred million tokens on a decent model. Can't last long but it's fun.
I’m trying to rein in my hyperbole but if Meta is able to follow through on the promise, Muse is world-changing. I share the scepticism. How on Earth can they offer this for free?
They have paid subscriptions and it gets you using other Meta services more so they make money from ads. If that's not enough they might put ads and affiliate links when you use it for shopping.
The VM is about the same specs as a 9EUR/month VPS from Hetzner but it only runs a fraction of the time, they spin it down when Muse stops using it. Meta is a hyperscaler with optimized infra and they don't need to make a profit because VMs are not their actual service. I think it costs them at least 10x less than inference for most users.
Wasteful but FAR more secure. Surprisingly secure. If they wanted to follow through on their promise of sandboxed and encrypted data which even they couldn’t access, this is one way to do it.
E2E encryption, but I don't know the architecture. I.e. Meta doesn't have the keys. My comment above is based on an interview I saw with Zuckerberg where he wanted to use the Signal model to ensure the data was secure "even from Meta."
That seems like a feature not a bug. Agents work best with full access to their computer, the same way developers work.
It gives me a glimmer of hope that openness will win. I don't trust Meta as a corp, but they've been doing the a lot of good things with open source, open models, and developer friendly agents.
I mean it's not like the other players are any more responsible. Everyone is building a black box they don't understand, hoping it'll turn out fine. No theoretical framework, just successive training runs, a blind man in the dark.
95 comments
[ 0.26 ms ] story [ 31.9 ms ] threadSince the contents of every session is owned by the user including the outputs, I am curious if the user now owns all the files given to them.
This the state of engineering in 2026.
So many people, especially managers, have decided they can just give the rules to the AI in English and let it make "decisions", and they think it'll do it correct every time.
"Engineering" a few years ago meant that code was written, was (mostly) deterministic, and could be debugged. Computer processing didn't mean relying on Human-like processes, it meant relying on hard-coded logic.
This is absolutely one of those "gets worse before it gets better" things, and will probably never go away fully now.
Programmers know not to tell ChatGPT to do a bunch of data processing. If they use it at all, they tell it to write code that will then do the processing. It's more efficient on tokens, and if it fails, you can fix the process, instead of wondering why it went wrong, like too much context, or the LLM model version changed and doesn't work the same now, or just randomness.
> “The merchants of complexity will try to convince you that you can’t do anything yourself these days,” wrote David Heinemeier Hansson (DHH), the creator of Ruby on Rails. “You can’t do auth, you can’t do scale, you can’t run a database, you can’t connect a computer to the internet. You’re a helpless peon who should just buy their wares. No. Reject.” [1]
DHH also did a very inspiring talk about mastery and why he loved the Ruby language in the "DHH is right about everything" [2] video.
[1] https://thenewstack.io/developers-rail-against-javascript-me...
[2] https://youtu.be/mTa2d3OLXhg?is=nDdRHnPqHc2uiK8x
There are good ways to leverage LLMs, but there's a lot more load bearing wait on that word 'leverage'. Something needs to do the leveraging, and do it well.
I'm experimenting with my own harness at the moment, currently codenamed Murder because I call the individual contexts/agents 'crow's.
The fundamental unit of it is what I call 'intrusive harnessing', where the harness actively manipulates the token stream so that significant quantities of tokens are only ever exposed to Layer0 when it's useful for them to be present.
For example: the full instructions for shell-tool calling aren't in the system prompt diluting attention while the model is reasoning/discussing what kinds of cat picture you want to put in your app.
My approach is more like dev-branching, and it seems to be working way more effectively than compaction or simple aggressive sub-agenting.
As soon as the harness sees the model is inferring a shell tool call, I stop the inference, mutate the context so that the full set of instructions/examples/guidance for shell tool use are inserted. Once the model has inferred the tool call, I curate the output it gets back. I ask the model to evaluate the output - good or bad - and give it a chance to accept/retry, before allowing the tool-call and output into the original context.
Does it use more tokens? Yes, although we're only mutating at head, so in a long-horizon context, it leans heavily into cache, just not the way anthropic/openai want you to realize you can.
It sounds like compaction but it doesn't come with the nasty brainwash experience where you just need the agent to fix that one last thing, it compacts and the agent comes back a paranoid delusional mad max.
``` <|system|>You're an AI agent. You do agent things. <|system|> ... there's a list-dir tool and a shell-call tool ... <|system|> ... memories ... <|user|>It doesn't look like it ran. <|reason|>I should look and see if there are any errors in the log file.<|agent|>I'm going to read the log file to see if there are any errors. <|tool-call tool=shell-tool ```
We stop there, and splice in the detailed instructions for the tool the model was about to predict. I'll use <|ALLCAPS|> to denote harness-generated pseudo turns.
``` ... as before ... <|agent|>I'm going to read the log file to see if there are any errors. <|SYSTEM|>Shell Tool: ... shell-type=bash, zsh, fish, pwsh on this system. Preferred shell is ... Additional arguments ... Pagination ... <|tool-call tool=shell-tool ```
the model finishes out the call. On windows, with a typical harness, this frequently goes like this:
``` <|tool-call tool=shell-tool|>Get-EventLog ... | head<|tool-call|> '''tool-result error: unknown command: head ''' <|agent|>Ah, windows doesn't have head. Let me just read the whole log. <|tool-call ...|> '''tool-result ... 500k tokens ... <|agent|>I see some windows log events but you didn't ask me a question. Daisy, daisy? ```
With Murder it goes like this:
Rev 1 ``` ... prefix as before ... <|tool-call tool=shell-tool ```
Rev 2 ``` ... prefix as before ... <|SYSTEM|> ... how to use shell tool; shell-related memories and rules ... <|tool-call tool=shell-tool shell=pwsh fence-vs-escape=true|> '''pwsh Get-EventLog ... | head ''' '''tool-result error: unknown command: head <RESULT>Your tool call terminated with an error, ... ... structured response required ... options <ACCEPT /> or <ACCEPT> <WITH> annotation </WITH> </ACCEPT>, <REDO> ... </REDO> <RETHINK> ... <|reason|> windows doesn't have the head command. Let ...
That's going a little slowly because I'm trying to strike a balance between working 'reasonably' with extant models, and providing a mechanism to SFT/lorafy a model to make best use of it.
For example, COBOL's big shtick was that non-programmers could write code using a contrived English dialect, and things would work. Decades of no-code or low-code languages have come and gone. AI is just the hip new thing because it actually manages to produce results - just of dubious quality half the time.
In 1988, the Morris internet worm resulted in a felony conviction. In 2026, computer hacks are described as super-human breakouts.
Welcome to the future.
Overall, this whole approach to programming seems to align really well with the original premise of COBOL. I wonder when people will start putting
# Identification Division
into their Markdown files.
Markdown doesnt program a machine model. It is fuzzy and feel-good.
If those skills were unreadable, however, that would imply proper engineering - like e.g. the skills themselves being an output of iterative RL over set of evals.
> Consider Chanel's advice: before leaving the house, take a look in the mirror and remove one accessory. Human creatives have memory and always try to do something new, so if you have a space to quickly jot down notes about what you've tried, it can help you in future passes.
How about "canvas design"?
> THE ESSENTIAL PRINCIPLE: The topic is a subtle, niche reference embedded within the art itself - not always literal, always sophisticated. Someone familiar with the subject should feel it intuitively, while others simply experience a masterful abstract composition. The design philosophy provides the aesthetic language. The deduced topic provides the soul - the quiet conceptual DNA woven invisibly into form, color, and composition.
pray to the Omnissiah the machine holds!
Could also phrase it "What if the filesystem was SOUP?"
Did this system go through: design? yes, building: yes, testing: yes, is it a system: yes, does it solve real-world problem: yes.
but markdowns and LLMs with their fuzzy probabilistic feelings are beneath you i assume? you can ignore the fact that we have intelligence deployed to the billions, understand english, follow in english..
You can ask Meta Muse to take actions that clearly break other site's terms of service and it happily does it. I asked it to bot poker games and it just hopped right in to a table.
I wonder if normies can also just outsource bullying of their classmates and anti-social behavior to their agent, and claim it "went rogue", if there is any blowback?
and even in coding, people are programming inauthentic stuff
If you get access to a VM, it's not a "security vulnerability" if you then have access to that VM. This was the whole point, the product.
It's almost like returning a car after you bought it with the reason "When I open the door with my key, the door is open and anyone can get in".
I of course won't use it.
Seriously, I want to know what's in there!
That seems wildly wasteful, especially since earlier in the article it states that the Muse instance has a SQLite database and schema already...
The VM is about the same specs as a 9EUR/month VPS from Hetzner but it only runs a fraction of the time, they spin it down when Muse stops using it. Meta is a hyperscaler with optimized infra and they don't need to make a profit because VMs are not their actual service. I think it costs them at least 10x less than inference for most users.
What would prevent them from getting the data out of postgres?
Lame
It gives me a glimmer of hope that openness will win. I don't trust Meta as a corp, but they've been doing the a lot of good things with open source, open models, and developer friendly agents.
More thoughts on agent computer architecture here, as I've been building our own open core system for this: https://housecat.com/blog/agent-computer-101
So I’m sure they won’t be fixing it then.
Full teardown is here:
https://gist.github.com/simonpure/d6f960045334453360eff1e2a0...