Meta has paused the sharing feature in Muse, its new general-purpose AI agent, after researchers reported that conversations shared through web links could be located and read by people who were never given the link. The company said it is reviewing the report and weighing changes to the feature.
Like many online services, Muse lets users share conversations, searches, images and other content by generating a unique URL that opens a page hosting the material. Such links normally include a long, hard-to-guess string of characters so that only intended recipients can find them. Muse appears to follow that convention, and Meta CEO Mark Zuckerberg said last month that the product was "built from the ground up for privacy and security."
Researchers at the security firm Claroc said a design choice in how the links are built undermines that protection. They said they were able to enumerate 6,800 links that Muse users had created to share conversations. After opening a few hundred, they found material that was plainly not meant to be public. "If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query."
The material they found included a candidate's notes for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time, and a national marketing company's internal revenue review marked for its CEO. Others were a small-business owner's loan application showing the amount requested and a to-do list containing a bank fraud alert with a partial account number, transaction amount and time. The researchers also cited a real-estate investor's internal performance report with two property addresses and exact return, income and mortgage figures, and a workplace's full-year staff vacation calendar listing dozens of employees.
According to Claroc, every Muse share link uses the domain cf.metaaiusercontent.com, and the conversation's title is placed in the subdomain alongside a long string of text. Because the title sits in the subdomain rather than in the URL path, it is captured by passive DNS services. These commercial services store historical records of how domain names resolve and are generally populated when a monitoring system observes a DNS response. Once an intended recipient clicks a share link, the record becomes searchable in such a database.
"Plenty of AI assistants share by public link," Claroc said. "What makes Muse's shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search." The firm calls the problem "GhostShares."
Asaf Aprozper, a cofounder and CTO of Claroc, said he reported the findings through Meta's bug bounty program on October 8 and also tried to contact people at Meta on LinkedIn. He said he received no reply through either channel.
In a statement responding to questions from Ars Technica, Meta said it opened the Muse bug bounty program so researchers could raise different scenarios and help improve the product. It said users can share specific Muse artifacts, creating a page accessible to anyone with the link, but that it has "paused this functionality while we review this report and consider changes to how these links can be discovered."
Muse rose quickly to a top position in Apple's App Store. The assistant can fill out forms, book appointments, make purchases and create documents, and it needs access to most of a user's accounts to do so. Three weeks after launch, macOS security expert Patrick Wardle found a zero-day vulnerability that let any other app on the same device take full control of a user's Muse account. Meta played down its severity because exploitation required an already compromised device, but did not acknowledge Wardle's finding that a simple ClickFix attack was enough to hijack an account. With sharing suspended, Muse users no longer face this particular exposure, at least for now.
