Meta has paused the sharing feature for Muse, its new general-purpose AI agent, after researchers found a design flaw that exposed private conversations via public web links.
The vulnerability
Meta CEO Mark Zuckerberg previously stated the tool was built from the ground up for privacy and security. However, the way the company constructed URLs for shared content created an opening for discovery. Researchers from security firm Claroc used a single query to enumerate 6,800 links created by Muse users.
Opening a few hundred of these links revealed data that should not have been publicly accessible. The exposed files included:
- Notes from a candidate preparing for a confidential executive search call with a frontier AI lab, including the internal contact name and meeting time.
- An internal revenue review from a national marketing company marked for its CEO.
- A loan application from a small-business owner showing the requested amount.
- A to-do list containing a bank fraud alert with a partial account number, transaction amount and time.
- An internal performance report from a real-estate investor listing two property addresses and exact figures for return, income and mortgage.
- A full-year staff vacation calendar for a workplace listing dozens of employees and the week each would be away.
“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”
How the links were found
The easiest method to uncover the URLs was a passive DNS search using commercial services. These systems store historical records of domain names resolving to IP addresses, nameservers and mail servers. When a user clicks a share link, the DNS information is recorded in a searchable database.
All Muse share links used the domain name cf.metaaiusercontent.com. Discovery was made easier because the conversation name was added to the URL alongside a long string of text. Simplified examples include home-sale-budget-9f21c8a3.cf.metaaiusercontent.com and q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com.
The critical design decision was placing the conversation title in the subdomain rather than the URL path. This allowed public DNS records to index the pages for anyone to search. Claroc researchers call these GhostShares: pages that open for people who were never handed the link and that those people can find on their own.
Meta’s response
Meta opened the Muse bug bounty program so researchers could raise different scenarios and help improve the product. The company stated that people have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, Meta has paused this functionality while it reviews the report and considers changes to how these links can be discovered.
Asaf Aprozper, a cofounder and CTO of Claroc, reported the findings through Meta’s bug bounty program on October 8. He also tried reaching people at Meta on LinkedIn but received no reply either way.
What it means
Muse quickly moved to one of the top spots in Apple’s App Store. The assistant autonomously fills out forms, books appointments, makes purchases, creates documents and carries out all kinds of other actions. To work as intended, Muse requires access to most of a user’s accounts. Meta has heavily marketed the assistant as a platform worthy of the extraordinary trust it needs to function.
Three weeks after the Muse launch, macOS security expert Patrick Wardle discovered a zero-day vulnerability that allowed any other app installed on the same device to gain complete control of the user’s Muse account. Meta downplayed the severity of the vulnerability on the grounds that exploitation was not possible unless a device was already compromised. The company did not acknowledge Wardle’s finding that a simple ClickFix attack was all that was needed to hijack an account.
The ease in discovering share links further justifies asking if Muse is worthy of the access it requires. With Meta’s suspension of the feature, Muse users no longer face this particular threat, at least for now.
