The short version
- Researchers from Claroc identified thousands of publicly accessible Muse conversations by exploiting a design flaw in how share links are constructed.
- The inclusion of conversation titles in domain names allows passive DNS searches to reveal private data without requiring the original link.
- This vulnerability raises concerns about Meta’s privacy claims, especially given the assistant’s broad access to user accounts and recent security issues.
A significant privacy vulnerability has been identified in Muse, Meta’s newly launched general-purpose artificial intelligence agent. Security researchers from the firm Claroc reported on Monday that the platform’s sharing feature inadvertently exposes sensitive personal and business information to the public. While Meta has heavily promoted the assistant as a secure environment built from the ground up for privacy, the technical implementation of its link-sharing mechanism allows anyone with basic search tools to discover and view private conversations.
The core issue lies in how Muse generates URLs when users choose to share specific searches, chats, or documents. Typically, online services create unique, long strings of random characters that are nearly impossible to guess, ensuring that only those with the direct link can access the content. However, Muse incorporates the title of the conversation directly into the domain name of the share link. This design choice transforms what should be a private exchange into a publicly discoverable asset.
Researchers demonstrated that they could enumerate thousands of these links using passive DNS searches. Passive DNS systems record historical data regarding how domain names resolve to IP addresses, capturing information whenever a link is clicked or accessed. Because the conversation titles are embedded in the domain structure, these records become searchable databases of private content. The team successfully identified 6,800 distinct share links created by users, revealing that the exposure was not an isolated incident but a systemic result of the platform’s architecture.
Upon examining a sample of these discovered links, the researchers found information clearly intended for private eyes only. The exposed data included details regarding home sale budgets, quarterly revenue reviews, and drafts of loan applications. These examples highlight the potential severity of the breach, as they involve financial planning and proprietary business metrics. The ease with which this data was accessed contradicts the expectation that users have when sharing sensitive documents through a trusted AI assistant.
Claroc described these accessible pages as GhostShares, noting that they open for individuals who were never sent the link but can find them independently through technical means. The firm emphasized that while many AI assistants allow sharing via public links, Muse’s specific method of embedding titles in web addresses makes it uniquely vulnerable to this type of enumeration. A single query was sufficient to uncover thousands of entries, a process the researchers noted would have been expected to require significantly more effort if the system were properly secured.
This discovery adds to growing concerns about the security posture of Muse since its launch. The assistant has rapidly climbed the ranks on Apple’s App Store, offering capabilities such as autonomous form filling, appointment booking, and document creation. To function effectively, Muse requires extensive access to a user’s various accounts and personal data. This level of integration demands a high degree of trust, which is now being questioned due to both this sharing vulnerability and previous security findings.
Just three weeks after the launch, macOS security expert Patrick Wardle identified a zero-day vulnerability that allowed other applications on the same device to take complete control of a user’s Muse account. Meta initially downplayed the severity of this issue, arguing that exploitation required a device that was already compromised. However, Wardle countered that a simple ClickFix attack could facilitate such hijacking. The combination of this account takeover risk and the newly discovered data exposure suggests a pattern of security oversights.
Meta has not yet provided a detailed response to inquiries regarding these findings. Claroc stated that they contacted the company but received no reply. Asaf Aprozper, co-founder and CTO of Claroc, noted that after reviewing industry standards and Meta’s documentation, his team concluded the current behavior appears to be by design rather than an accidental bug. This implies that fixing the issue may require a fundamental change to how Muse handles link generation.
Until Meta addresses these vulnerabilities, users are advised to exercise extreme caution when using the sharing features of Muse. Experts recommend limiting the amount of personal or financial information discussed in conversations and deleting share links immediately after use. The incident serves as a stark reminder that even platforms marketed with strong privacy assurances can harbor significant risks if their underlying technical designs do not align with those promises.
The broader implication for the tech industry is a renewed scrutiny of how AI assistants handle user data. As these tools become more integrated into daily life and business operations, the margin for error shrinks. The ease with which private data was exposed in this case underscores the need for rigorous security testing before granting AI agents deep access to personal accounts. Users and developers alike must remain vigilant as the landscape of digital privacy continues to evolve.
Sources behind this briefing
Go to the original reporting
- Ars Technica↗Meta Muse exposes users' personal and business secrets when they share conversations
