Meta Muse exposes sensitive data via discoverable sharing links

Meta Muse, a general-purpose AI agent, exposes sensitive user data when conversations are shared via web links because the links are easily discoverable through passive DNS records. In response to the security findings, Meta has suspended the sharing feature while it reviews the functionality and considers implementing changes.

The Core Vulnerability

The vulnerability stems from a central design decision in how Muse constructs its sharing URLs. Instead of using a secure, non-guessable unique identifier, the system embeds the conversation name directly into the subdomain of the URL. This structure allows external parties to enumerate and discover shared content without needing the original link.

Researchers from the security firm Claroc were able to enumerate 6,800 links created by Muse users. After examining a few hundred of these links, the researchers found highly sensitive information that was not intended for public access. Examples of exposed data included:

Notes from a candidate preparing for a confidential executive-search call, including the internal contact and meeting time of a frontier AI lab.
An internal revenue review for a national marketing company, marked for its CEO.
A small-business owner’s loan application, detailing the requested amount.
A to-do list containing a bank fraud alert, including a partial account number and transaction details.
An internal performance report from a real-estate investor, listing property addresses and exact financial figures.
A workplace’s full-year staff vacation calendar, listing dozens of employees and their absence weeks.

Technical Mechanism of Discovery

The ease of discovery is facilitated by the use of passive DNS records. Passive DNS systems collect historical resolution data, including domain names to IP addresses, from DNS resolvers. When a user clicks on a Muse share link, the DNS information is recorded in a searchable database.

Claroc researchers identified the Muse share links because they all utilize the domain name cf.metaaiusercontent.com. The critical flaw is the inclusion of the conversation title within the subdomain, such as home-sale-budget-9f21c8a3.cf.metaaiusercontent.com. This design choice makes the content title publicly discoverable via passive DNS searches, a phenomenon the researchers termed "GhostShares."

Meta's Response and Mitigation

Meta acknowledged the issue and responded to questions from Ars Technica in an emailed statement. Meta stated that the company opened the Muse bug bounty program to encourage researchers to identify various scenarios and aid in product improvement. The company confirmed that it has paused the sharing functionality while it reviews the report and considers changes to how these links are discovered.

Asaf Aprozper, co-founder and CTO of Claroc, noted that he reported the findings through Meta’s bug bounty program on October 8 but received no reply when attempting to contact Meta representatives on LinkedIn.

Broader Security Context

This vulnerability highlights significant security concerns regarding the deployment of powerful, highly privileged AI agents. Muse requires extensive access to a user's accounts to function, leading to concerns about the trust users must place in the platform.

Beyond the sharing link vulnerability, the platform has faced other security issues. Three weeks after its launch, macOS security expert Patrick Wardle discovered a zero-day vulnerability that allowed any other app on the same device to gain complete control of the user's Muse account. Meta downplayed this finding, but the ease of discovering share links further compounds questions about Muse's overall security posture.

Commenters synthesized several points regarding the risk and responsibility associated with AI assistants:

"The ease in discovering share links further justifies asking if Muse is worthy of the access it requires."

Another discussion point focused on the broader implications of large tech companies handling sensitive data:

"Muse is the most obviously doomed claw-style bot because you already need to segment those things from ANY personal info, and Meta rolls into the room as the journal that will tell everyone what you write in it and says 'trust me' Part of a huge problem with FAANG companies."

Alternative Approaches to Privacy

In response to the privacy risks posed by centralized, data-intensive AI platforms, some users and developers are exploring self-hosting and decentralized solutions. One commenter noted the viability of self-hosting options, stating:

"...there will be viable options for self-hosting too. I am already doing it [link to github repository]. The Hub powers the entire family inference needs through a single device - 4 users - 8 device about 50 agents - mixture of local models and some subscriptions."

These alternatives suggest that for users prioritizing data sovereignty, leveraging open-weight models and regional cloud services is a growing trend.