Meta Muse Pauses Sharing After Shared Chats Prove Easy to Find
Meta has suspended link sharing in its Muse AI agent after researchers found thousands of private conversations could be discovered through a simple DNS search.
Meta has paused the sharing feature in Muse, its new general-purpose AI agent, after security researchers showed that shared conversations could be found by people who were never given the link. The company says it is reviewing the issue and weighing changes.
According to a report by WIRED, which was originally published by Ars Technica, researchers at security firm Claroc enumerated 6,800 share links. They opened a few hundred and found material clearly not meant to be public: a candidate's notes for a confidential executive-search call, an internal revenue review marked for a CEO, a small-business loan application with the requested amount, a bank fraud alert with a partial account number, and a real-estate investor's performance report with property addresses and mortgage figures. A full-year staff vacation calendar was also among them. "It took one query," the researchers wrote.
Why the links were discoverable
All Muse share links sit under the domain cf.metaaiusercontent.com, and the conversation title is placed in the subdomain, followed by a long random string. Passive DNS services record domain lookups once someone opens a link, which turns those subdomains into a searchable database. Claroc calls the resulting pages "GhostShares." Putting the title in the subdomain rather than the URL path is what makes public discovery possible.
Claroc cofounder and CTO Asaf Aprozper says he reported the findings through Meta's bug bounty program on October 8 and also tried contacting Meta staff on LinkedIn, without a reply. Meta said users can share specific Muse artifacts via a link-accessible page, but it has paused the function while it considers changes to how the links can be discovered.
A trust question for Muse
Muse rose quickly to the top of Apple's App Store. It fills out forms, books appointments, makes purchases and creates documents, and needs access to most of a user's accounts to do so. Mark Zuckerberg said last month it was built from the ground up for privacy and security.
Three weeks after launch, researcher Patrick Wardle reported a zero-day that let any other app on the same device take control of a Muse account. Meta downplayed it, arguing exploitation required an already compromised device. With sharing suspended, users no longer face this particular exposure, at least for now.
