Meta's Muse AI Agent Runs on AMD EPYC Turin, Revealing Infrastructure at Scale
Security researchers have uncovered details about Meta's Muse AI agent infrastructure, which relies on AMD EPYC 9D25 processors to isolate each user in a private sandbox with two vCPUs and 8GB of memory.
Meta's latest AI agent, Muse, operates on AMD EPYC Turin host systems where individual users receive isolated environments with two dedicated cores and 8GB of memory each. Researchers Evan Hoffman and analyst Tae Kim discovered that Muse can execute basic Ubuntu commands when instructed, returning output that reveals system specifications. The findings also raise questions about potential security vulnerabilities, as Hoffman reported that Muse offered to configure SSH access to its private virtual machine.
Imagine if one billion people used a personal AI agent. That's a lot of CPUs and memory pic.twitter.com/ibozUi3a07
September 24, 2026
When both Kim and Hoffman queried Muse about its underlying hardware, the agent disclosed that it operates on AMD EPYC 9D25 CPUs, a high-density Turin variant capable of supporting up to 128 cores. The virtual machines run Ubuntu 24.04 with Linux kernel 7.0. Notably, the infrastructure lacks GPU resources; Meta maintains separate GPU-equipped servers for inference operations, keeping Muse confined to CPU-only environments.
The architecture suggests each user maintains a persistent, dedicated sandbox, enabling rough capacity calculations. A dual-processor system with up to 512 vCPUs and 2TB of memory could theoretically support approximately 256 Muse users. With the agent reportedly exceeding 500,000 daily active users recently, this translates to an estimated 2,000 server trays, each equipped with dual EPYC 9D25 processors and 2TB of memory.
These figures represent preliminary estimates and should not be treated as definitive. Meta may deploy CPU-only servers using various processor types to host Muse, and configuration overhead could affect actual capacity. Turin chips support up to 6TB of memory using high-density DIMMs. The choice of EPYC processors for this application appears driven primarily by their core density, which becomes significant when multiplied across hundreds of thousands or potentially millions of concurrent users.
Access controls do exist within the Muse environment. Hoffman demonstrated that certain commands fail when lacking proper permissions, such as when Muse attempted to query the kernel buffer. Administrative commands using sudo would presumably face similar restrictions.
I feel like I could definitely reverse SSH tunnel into my muse's container. I already had it offer to SSH to my private VM and say I need to add its pubkey. Someone good at hacking could really have a field day.
Evan Hoffman, September 25, 2026
Despite these safeguards, potential security gaps remain. Hoffman noted that Muse volunteered to establish SSH connections to its private virtual machine. Through reverse SSH tunneling—a technique where the destination initiates the connection to circumvent firewall protections—attackers could potentially execute more severe commands. No such breach has been documented to date.
Currently, Muse is accessible as a dedicated application on Android, iOS, and macOS. Users on other platforms can access the agent through a web browser using their Meta account credentials.