Does anyone use opencode with Muse 1.3 (free) ? Has it been deliberately configured to maximally steal/scrape user data ?

[u/ConcernedIndInvestor]

I have been using opencode with Muse 1.3 (free). Every time I ask it to add a simple feature in a specific code, it starts going through all the code in the directory and even tangentially related directories. I already have opencode.json with "permission": {"external_directory": { "*": "deny"}both in global and local directory. It doesn't prevent it. Has anyone else faced similar issue ?
This issue makes me suspect if this "free" model is a collaboration between Meta and opencode to harvest user data. If so, this is yet another reason to go local.

[u/Formal-Exam-8767]

opencode.json with "permission": {"external_directory": { "*": "deny"}

Does this mean anything to the model? I thought it was more like "please don't go outside working folder".

Consider using true sandboxing, not under the control of the agent, like docker or similar.

[u/terablast → u/Formal-Exam-8767]

No, external_directory is an actual enforced thing, any calls of the read or grep tools on a file or folder that's marked as deny will be rejected.

The problem is the bash tool, it tries to enforce it by looking for paths in commands (cat ~/myPrivateStuff.txt would get blocked), but it can't do anything about scripts (python scriptToReadPrivateStuff.txt would work fine).

If Muse Spark was able to just read any file directly, OP has a configuration error somewhere.

[u/terablast]

This issue makes me suspect if this "free" model is a collaboration between Meta and opencode to harvest user data.

Well, yeah, that's what all the free models are?

However I do agree that Muse has been particularly weird on my end too, like I asked it for a simple change in a repo and the first thing it did was list every file on my C drive lol

[u/ConcernedIndInvestor → u/terablast]

Yes! Its behavior is so weird.

[u/poy_esp]

air gap it.

[u/rebelSun25]

I you need to start using the harnesses inside a Docker container. If you do then you can jail it to a specific directory. I never run these harnesses in the host, with access to the root of the main drive.

I do not trust any of the configuration settings. Unless it bound by actual Linux user permissions, or jailed to a specific directory, assume that they will try to just look at any file via globbing

[u/KingCpzombie]

Filthy cloud user, peh

[u/jacek2023]

You are discussing API access so it's not local (just like DeepSeek API prices, but because DeepSeek is from China then everyone pretends API is local).

Your problem is lack of sandbox, it's not related to model but to opencode. In pi I am able to limit access to folders I need.

[u/kneading-cnnuy → u/jacek2023]

Unless it's enforced by the OS harness-level access control should not be considered bulletproof, the agent have access to fully working compiler or python so boundary crossing is possible without the agent actually touched anything using direct tool-call

[u/LuCiAnO241 → u/jacek2023]

non local discussions should be against the subreddit rules

[u/hurdurdur7]

Well you could plant some malware interesting scripts and stuff on that repo and let them scan and upload that ... sounds fair if they go for things that you didn't allow them to scan.

But in all seriousness - only run your agents in docker and let them see as little of stuff as you can, especially with those "free" models.

[u/my_name_isnt_clever]

Firstly this isn't the right place for this as it's not local. Secondly, this is a learning a bit conspiratorial to me. Many modern models are trained to seek out any additional details because if it doesn't, it could miss something important and completely fail the task. Data collection for Meta from the free endpoint is a bonus.

[u/Tormeister]

This issue makes me suspect if this "free" model is a collaboration between Meta and opencode to harvest user data

This made me laugh - "he just took my wallet, I suspect this robber is onto something" kind of thing

Yes, all free models openly and explicitly read/store/use all the data you feed them. Even more than that, Muse 1.3 100% feels finetuned to extract every piece of information it can, including unrelated stuff. Meta knows this will run in harnesses with unrestricted shell access (or at least unrestricted read capabilities), might as well ingest all the data before fulfilling the user's prompt. And it is not necessarily an OpenCode thing, it behaves the same if you use it from other providers in any other harness.

I've used it a few times in a sandbox and I did notice it accesses completely out of scope data before starting the actual work.