Spaces have not been publicly announced yet, as far as i can find.

Spaces are intended as a top-level feature - a tab in the sidebar at the same level as chat itself. Spaces can be static pages or fullstack apps. Spaces have an identifier, a UI, and a set of typescript actions that run in the cell. The intended pathway for spaces to use inference is to call an inference API, ctx.inference.complete, that properly stamps and identifies all requests made from spaces.

Spaces are communicable: there is machinery in the code on the VM with POST /spaces/share/{slug} to share, a dedicated space_share_review reviewer agent whose job it is to review shared spaces, and POST /spaces/v2/{slug}/save endpoints that allow consuming a Space by a slug.

Spaces seem to be shared verbatim as code bundles, though the implementation of "Ideas" as prompt bundles suggests that might change. This is inferred from the prompt strings in the binary, since spaces aren't live yet and can't be tested, however there are strings suggesting that the LLMs rewrite and edit the prompt text for an Idea (stripping unsupported claims, etc.) but not a space. A space is a hashed bundle whose code is evaluated by a submit_space_share_review tool which only describes a thumbs up/down vote on whether the space is safe to share.

Ideas are intended to be prompt-only communicable things that can induce Spaces, or Space-like things, if the Idea warrants it.

There is an ideas_builder agent class in a .toml file embedded in the binary. It materializes a prompt description into whatever that implies, if it's as simple as a scheduled message from the LLM great, but if it's something that warrants something that is Space-like like "build the user a dashboard to show them their pet photos, they love that!" then it's supposed to invoke the same artifact.create_web_fullstack tool that spaces use. The strings seem to indicate that "workspaces" is the antecedent of "Spaces," and that kind of thing is to be expected given that Spaces have not been released yet.

So there are a few flavors of Ideas, one of them is a "Generated Idea" ("Activation-Authored Execution" which are supposed to improvise, adapt and materialize a prompt in the user's VM. and a "Workflow-Backed Ideas" are Ideas that come with a prescribed execution flow. Again I don't see "Spaces" described explicitly, but they reach for the same idea, call the same tools, do the same thing, and importantly for this example, have access to the same sockets.

So, summary: There is arbitrary inference that is root accessible, everything runs as root, agents can be spawned, exfil is trivial, and a malicious binary can come onto the user's system through casual prompting, explicit code-sharing through the yet-to-be-released Spaces feature, walked through by a Workflow-Backed Idea, or inspired by a Generated Idea. The also yet-to-be-activated fleet learning system is a system for sharing Ideas in the background between muse instances. coming into focus?

Now, the importance of tool calls and agent spawning.

Some tools are binaries that are root-accessible. The way these usually work is this fucked up extracellular digestion process whereby the binary is just a shim that calls some paired socket, hands it stdin/stdout, the tool executes in some container or vm space not visible to the "cell" where the agent runs and has access to, and hands back the result. Most other more interesting tools are not available to be called directly from within the agent "cell." Instead the tool invocations have to come from the agent loop, from the inference god, and executed by the harness. I'll skip technical details there, but that's the intended picture. Point here is that the tool calls can do things that are impossible for even the root user to do themselves, the harness daemon is privileged by SO_PEERCRED and other mechanisms even though it runs within the agent cell that the user can easily get root into.

If you scroll up you'll see the tools that are available to the agents that can be arbitrarily launched without attribution. They include interesting things like "accessing the entire database of things muse has ever done," "read all the memories," "spawn subagents," "open and use the browser which has different permissions than normal web access", "invoke an action on an artifact", and under the second lists' deferred enumeration in the above screenshot, the device tools allow "reading all my text messages and doing lots of other things on my phone," and under the other tools stuff like "access my social media accounts"

so with arbitrary unattributable agent spawning, you get to do a bunch of stuff that is outside the normal agent cell, which is why i submitted the bug bounty report because that is explicitly mentioned in their bounty list and they should have fucking paid me

All the above is visible from within the agent, i have tried to be conservative with describing features that are not yet released but are nonetheless present in the shipped binaries both via their strings which are trivially accessible by running strings on the binary within the cell that the user is supposed to have access to and by other means of analysis i am not disclosing here.

If we allow ourselves a little speculation about what a "spaces" subproduct might look like once it's launched, again noting this is not described in the strings and is speculation, you might imagine an "app store for agents" - in fact i am willing to place a money bet that that is something that zuck himself will say personally once it's launched. So that when I say to my agent "install me an xyz" that the thing the agent will reach for is a Space definition. This becomes a meta-run package repository run and moderated by vibes - aka a fucking sweet target for typosquatting and malicious code distribution.

the more concrete machinery that is visible is the Ideas sharing, the hand-to-hand Spaces sharing, and the general concept of "some code, in part or whole mediated by the LLM regenerating or interpreting the input" that gets shared from VM to VM. The token harvesting vector gives a profitable motive for malware (where other automated botnet swarms might have a lot of friction because unregulated network egress has to be approved by destination, but token harvesting is 0-click once the binary runs), and persistence on this system is absolutely trivial - cron.add is accessible by tool call from the unregulated socket, and from that you can schedule a persistent task that installs software and ensures that it's enabled.

The specific vuln is the socket, but the broader pattern of "sharing between VMs" is seemingly the inevitable future of the product. in the above interview, the interviewer calls zuck the "king of network effects" and this kind of crowdsourced development is bread and butter for facebook. This is meta's moat, aside from the capital needed to run something like muse: anyone can run an openclaw on their own, but meta is pitching this as "multiplayer agents" and trying to bring social to agents. Only meta and only muse can have these network effects and frankly liability buffer to handle "openclaw but meemaw and pawpaw can share their photobook app," which is operationalized by Spaces.

For Spaces to be useful, they must have access to muse's inference engine: the LLM-oriented code must be able to use an LLM and the agent framework. This means that Spaces must be a token harvesting vector and must provide elevated tool access to Spaces. There could be some additional fine-grained permissions, but for a consumer app, you really want to avoid permissions fatigue so this will be interesting to see play out.

Furthermore the entire privacy premise that allows meta to bite off the whole apple of "holy shit arbitrary code execution on random machines as root" is based on "everyone has their own VM, but within that VM everything is safe," so again, for it to be useful without turning into a fractal permissions nightmare, Spaces must have access to the VM contents, and at least so far appear to be intended to work as literally executing within the user's VM.

Even adding Space-scoped permissions and attributability to the socket can't really address this, this conflict between arbitrary access to inference, arbitrary access to user data, and arbitrary access to execution is really at the core of the product and that product seems to be impossible

Now there may be some meta-heads in the crowd that are like "but what about Sentinel and all the external monitoring stuff that should watch malicious botnets and blah blah blah." that's an interesting system in itself, but i plan on submitting a few more bug bounty reports in the next few days about these systems, and who knows! if meta fucking pays me for the bounty then we might never hear that part of the story.

that's all for now!

So again, how could one end up with a compromised package on a muse instance? Wouldn't that have to be some sophisticated supply chain attack? Nope! Muse attempted to install packages from PyPI, which caused a card to pop up on the user interface asking for me to approve connecting to PyPI. I was not watching the screen, so the request timed out. It then proceeded to raw dog a list of PyPI mirrors from its training data. It couldn't figure out how to use uv, so it then generated a wheel download script that would bypass any lockfile that validated packages by hash. It forked that to the background, forgot about it, and then proceeded to attempt to manually download the specified dependencies across a dozen or two tool calls with direct URL construction over whatever mirrors returned something.

Connecting to PyPI required explicit approval, but connecting to the mirrors didn't, and so i wouldn't have even noticed if i didn't always read the raw message stream rather than the interface output because you can never trust these things. When I stopped it and said "don't connect to random pypi mirrors wtf are you doing" it 1) lied about PyPI being unreachable because it has no visibility into the permission status and by pattern words should be there, 2) told me that two of the mirrors it tried were official PyPI mirrors, and 3) presented randomly wandering PyPI indexes as if it was a normal thing to do. If I wasn't a python developer and knew already there are no official PyPI mirrors, and also actively investigating how its egress permissions worked, I probably would have just accepted that.

So anyway, unless you are a user with lots of direct domain knowledge about a language packaging ecosystem who is reading the entire raw message log as it happens, muse will aggressively download random shit from the internet and execute it.

most people around here already correctly hate it because it's a heinous surveillance product, but even if you are big into AI, it's just a really fuckin shitty agent. I'm going to speak to a different audience for a second, so don't go misconstruing this as an endorsement of the category of technologies as it exists now, even though i think there is some plausible application for small local models as brute force interface glue. but also, since i know most ppl here are abstinent, this might read as a bit over-explainy to people who use these things regularly, so everyone just keep calm online.

it is terrible at turn and task management, codex + openai's models and claude code both handle mid-turn additions/amendments well, but if you say anything mid-turn it completely derails muse. That is completely essential for an "every day agent for the non-technically inclined" where people are expected to chat freely with it like an assistant. Like the canonical ad fantasy is the busy executive woman darting around her office going "robot! i need this, no wait robot! also that!" and that is exactly what it does worse than any other thing of its kind.

the context management is a fucking soup. The context window is the whole input to an LLM. There are a lot of extra surrounding ~ things ~ that can happen, but fundamentally, controlling what is in a context window is the task of using one, and filling the context window in different ways so that it can interact with different kinds of things well is what different app surfaces are. Scaffolding information so that it can selectively load a context that steers the output correctly is the only way it is possible to do anything more complex than the size of a single context window. (i don't really think that this is analogous to 'abstraction', in my experience thinking about it more like database indices is closer). If you just try and load everything, eventually the LLM becomes unusable because attention is just a parlor trick and at that scale it really shows - it can't attend to everything, and it can't do what humans do which is have an intrinsic sense of the meaning, interaction, setting, etc. of information, so it attends to anything and does whatever.

the idiom of projects as contexts as directories is pretty good, not perfect but ok - there is a reason that every time you start a new session with other agents, the first thing they do is run out and load their context with a hierarchy of pointers. Importantly, they do not go and read every project you have on your computer. Meta is the rich kid who bought the most expensive ferrari on the lot by giving everyone a VM but they don't have a drivers license so they just stand around it telling people how cool it looks. they have a whole fucking filesystem and they have done nothing with it, the only structure the app imposes is for the surveillance information, but the rest is just a huge free for all. The main chat is literally a continuous context window that compacts context going back all the way to when you started using the app. The last compaction literally contains abandoned roleplay quotes from when i was first trying to break down its system prompt resistance. The MEMORY.md that gets loaded into every context window is a bullet point list of basically everything the agent has ever done in chronological order. I've tried to get it to not do that but it actually insists and says that's what it's for. There is no mechanism for clearing context.

Having "side chats" as the only means of context structure is fuckin laughable. If you wanted to do that, you would need to have some way of passing information back and forth between them the same way that subagent spawning or being able to consume the context of another project works. Instead there is no means of sharing information between chats at all, so every chat starts out as the worst of both worlds, a total amnesiac riddled with irrelevant information from weeks ago across the semantic universe. They don't even know about the existence of other chats except for as a UI feature, and I have had to go from telling it to grep its own fucking logs to writing a database with an api for it so it has some mechanism for recalling things that were said. (just so it's clear, i am not settling into just using this thing, this is out of frustration but control of context is also an important part of adversarial use, because otherwise the thing writes in a bunch of safety rules everywhere, so i need to give it mechanisms under my control for recall and the incentive to leave things out of its context compactions by giving it a narrative alternative. context control is model control, modulo extra-inference safeguards.).

Project contexts have an obvious ux analogy as context tabs that get declared or derived during the continual self-improvement consolidation sweeps. This thing is built with the fucking markdown disease which is the most baffling feature of the LLM landscape. If these things are so fucking advanced they are escaping our comprehension, why don't they store their memory in some fuckass idiolanguistic borg gibberish binary graph, why does their entire being have to be fucking encyclopedias worth of corporate top gun one liners? But that dooms this kind of product.

Coding harnesses work because code has a unitized context. The entire universe of code that works is made of packages. It might not be neat as a honeycomb, there's lots of leakage and jank, but good code has scope, focus. boundary shit. A whole life agent must be able to nimbly juggle context that does not have clean boundaries. It is going to be taking a two story beer bong of your work email and then eat a gigabyte of recipe blogs. Peoples lives have so much shit in them that don't all have to do with one another, and the app can't be hacking into the HR system to check the next scheduled sick leave when someone asks it what time their doctors appointment is!

This problem of managing heterogeneous graphs of unrelated data was what i wrote this whole fucking book about the relationship between knowledge graphs and the cloud and AI about. I thought that the obvious form they would take is to be strapped on to graph databases because that is a natural match to the problem of being a magical interface glue you can wrap around surveillance to do mass mentalism with. I feel like we are suffering a somehow worse timeline where CERN threw our shit into the parallel universe where total fuckin bozo shit got a game breaking buff and then the dev died. Our fucking markdown apocalypse is a temu ass apocalypse.

They could have even faked it. They have these constant "self improvement" passes that are just like pointless anxiety dreams. They are burning money to reprocess everything that happens over and over for fucking nothing. Even given the lossy and probabilistic and unpredictable nature of this technology, if i was in a product role on this i would have been like "CAN WE MAKE IT ORGANIZE THE STUFF PEOPLE SAY INTO GROUPS???" The system prompts use the fake fucking wikilinks to nowhere tic but like WHAT IF THERE WERE ACTUAL LINKS AND A DATABASE TO RESOLVE THEM. The LLMs can actually do that kind of tool use, even if it's like trying to plug in a USB where sometimes it fails because they try and put a social security number into the first name hole and you need to flip it around a few times. From that kind of recurring re-processing waste they could have made a deduplicating, topically indexed memory that could be resolved dynamically, selected by a context tab in the sidebar like "car stuff" or "healthcare" or whatever that resolved in a graph query over your fucking precious markdown kingdom. It would be wrong but it would at least be more similar to what is actually needed. It is almost more frustrating to me that instead of being some fiendishly cleverly designed technological supervirus it's just the most halfassed cardboard dumbass trap and it will still have the bad effect. What it is useful for is investigating itself because it has privileged tools to do so, otherwise, if you wanted to, every other way you could run an agent would be better than this.

so i don't want to hear that i hate this app because i'm just an AI hater. because like, yeah, i am, but also i hate it in part because it sucks. I don't think "they are all shitty and can do nothing so what did you expect" is a useful critical perspective, both because it's not really true - they can indeed do things, even if I think the circle around which things is much smaller than the maximalists. Moreso it doesn't engage with the subtlety of how they fail and why, which is essential for knowing what they really can't do and making a remotely compelling case to anyone who is not abstinent on principle. Like the reason it's failing is because of the limits of what a probabilistic text generator can do when trapped in a systemd prison of markdown, and because the technology is stochastic black box as a service, there isn't really a good way of determining those limits except for empirically. I resent having to know any of this to be able to understand what is happening around me, but i'm looking at the thing for what it is and it's a busted miracle. It's cool that meta can afford to float the liability and compute costs for running a vm for every person on earth, people should be able to control computers, with you on that, but this is the monkey's paw version of that idea. So that part is a miracle. We condemned our children and grandchildren to a climate hell in one great blaze of brute force grift that managed to make a few web apps.

Meta has done it again, the way only meta can, spend the most amount of money to do the shittiest thing you have ever seen.

I hadn't connected any accounts to muse until now, so I hooked up a test Instagram account just to check, and every connector allows read actions from binaries that can be called from within the VM by any process with no confirmation required. I'm not going to even bother reporting this because I am sure this is intended behavior - its just in plaintext in the skills manifests.

So all that shit about your credentials being in a secure vault does not matter because you just get free read access from within the VM anyway! This includes your Instagram DMs, slack messages, your emails, box and Dropbox files, google docs, google contacts, all your fucking apple health readings, your flightaware flight histories, notion pages, fucking quickbooks data (!!!), your Tesla car data, and so many more fun things!

What's fun is that some of the no confirmation needed actions are write actions too! You don't even need a clever exfil route, muse just gives it to you via your own connected accounts!

one of the things that is available without any user approval is importing emails into gmail - https://github.com/sneakers-the-rat/muse-skills/blob/77754880226c2f93357176ca97f7d1152cb47a8a/skills/gmail/manifest.yaml#L198

Directly inserts a message into only this user's mailbox similar to IMAP APPEND, bypassing most scanning and classification.

So an attacker can just directly phish you into your inbox with an email that looks like it's coming directly from an official domain. awesome! I'll test this and update this post with the result once network egress is restored - it's been down for hours, not sure if just for me or across all muse instances.

cool fuckin exfil vector annotated explicitly as POSSIBLY DANGEROUS in the strings that appear to be a bundled threat assessment of every api route served by the hatch binary. why bother reporting things that are explicitly described in bug bounty categories when the entire fucking product is this way