Researchers at security firm Claroc have discovered that Muse, Meta’s new general‑purpose AI assistant, can unintentionally reveal sensitive data when users share conversations via web links. In response to inquiries from Ars, Meta announced that it is temporarily disabling the sharing feature while it reviews the issue and considers possible changes.
Muse allows users to share searches, chats, images and other content by generating a unique URL that anyone with the link can open. Typically, such URLs contain a long, random string to prevent guessing. Although Meta’s CEO Mark Zuckerberg described Muse last month as “built from the ground up for privacy and security,” a design choice in how the URLs are constructed makes them easy to locate.
Claroc researchers were able to enumerate 6,800 share links created by Muse users. After opening a few hundred of those links, they encountered information that was clearly not meant for public view, including:
– A candidate’s preparation notes for a confidential executive‑search call with a frontier AI lab, naming the lab’s internal contact and meeting time.
– An internal revenue review for a national marketing company, marked for its CEO.
– A small‑business owner’s loan application, showing the amount requested.
– A to‑do list containing a bank fraud alert, with a partial account number, transaction amount and time.
– A real‑estate investor’s performance report, listing two property addresses and exact return, income and mortgage figures.
– A workplace’s full‑year staff vacation calendar, detailing dozens of employees and the weeks they would be away.
The researchers wrote, “If you had asked us beforehand, we would have guessed that gathering these would take real effort, it took one query.”
In an emailed statement to Ars, Meta said, “We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product. People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.”
Claroc co‑founder and CTO Asaf Aprozper reported the findings through Meta’s bug bounty program on October 8 and also attempted to contact Meta via LinkedIn without receiving a response.
The URLs can be discovered through a passive DNS search using commercial services that store historical domain‑to‑IP mappings and other DNS records. When a recipient clicks a share link, the DNS lookup is logged in a searchable database. All Muse share links use the domain cf.metaaiusercontent.com, and the conversation title is embedded in the subdomain together with a long string of characters. Examples include home‑sale‑budget‑9f21c8a3.cf.metaaiusercontent.com, q3‑revenue‑review‑7b1e42f0.cf.metaaiusercontent.com and loan‑application‑draft‑a4c9e2.cf.metaaiusercontent.com. Claroc noted that placing the title in the subdomain, rather than in the URL path, makes public discovery possible. They called the phenomenon “GhostShares,” describing pages that open for people who never received the link but can find it on their own.
Muse quickly rose to a top position in Apple’s App Store, offering autonomous form‑filling, appointment booking, purchases, document creation and other actions. To function, Muse requires access to many of a user’s accounts, and Meta has marketed the assistant as a platform that deserves a high level of trust.
Three weeks after Muse’s launch, macOS security expert Patrick Wardle identified a zero‑day vulnerability that allowed any other app on the same device to gain full control of a user’s Muse account. Meta downplayed the issue, saying exploitation required an already compromised device, and did not acknowledge Wardle’s finding that a simple ClickFix attack could hijack an account. The ease of discovering share links adds further concerns about whether Muse should have such extensive access.
With the sharing feature currently suspended, Muse users are not exposed to this particular risk for the time being.