breaking news
Muse share links leak private chats, and Meta has paused sharing
Claroc researchers enumerated 6,800 Muse share links, and the few hundred they opened held information never meant to be public.
6,800 links, a few hundred leaks
Researchers from Claroc said they enumerated 6,800 links that Muse users created for sharing conversations [1]. After opening a few hundred of them, they found information clearly not intended to be public [1]. Muse is Meta's new general-purpose AI agent, and anyone who shares its conversations through web links is exposed to this problem [1].
Meta said it is suspending the Muse sharing feature while it reviews the issue and considers changes [1]. Muse allowed users to share searches, conversations, images, and similar content with other people [1].
What the exposed pages held
One exposed page contained a candidate's notes for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and meeting time [1]. Another was a to-do list with a bank fraud alert, a partial account number, and a transaction amount and time [1]. A third was a workplace's full-year staff vacation calendar, listing dozens of employees against the week each would be away [1].
Claroc calls these exposed pages GhostShares [1]. A Claroc researcher said gathering the exposed information took one query [1].
Why the links could be found
Share URLs typically contain a long sequence of text that is hard to guess, which keeps sensitive information from unintended people [1]. Muse links had a different weakness: all of them use the domain name cf.metaaiusercontent.com, which made them discoverable [1].
The easiest way to discover the share URLs is a passive DNS search through commercial services [1].
The disclosure timeline
Claroc cofounder and CTO Asaf Aprozper reported the findings through Meta's bug bounty program on October 8 [1]. He also tried reaching people at Meta on LinkedIn but got no reply [1].
Meta said it opened the Muse bug bounty program so researchers could raise scenarios and help improve the product [1]. It also said it paused the link-sharing functionality while it reviews the report and considers changes to how links can be discovered [1].
Why Muse holds so much data
Muse quickly rose to one of the top spots in Apple's App Store [1]. To work as intended, it requires access to most of a user's accounts [1].
What this means for you
If you use Muse, the sharing feature is suspended for now while Meta reviews the issue and considers changes [1]. Muse let users share searches, conversations, images, and similar content [1], and every share link uses the same domain name, cf.metaaiusercontent.com [1].
That shared domain made the links discoverable, and Meta said it is considering changes to how links can be discovered [1]. Claroc's sample shows the range of what can sit behind a link: a job-search note, a bank fraud alert and a staff vacation calendar [1].