Meta Pulls Muse Sharing Feature After Researchers Find Private Chats Were Publicly Discoverable

Meta has suspended the link-sharing feature on Muse, its new AI agent, after security researchers found they could discover thousands of users' private conversations without anyone handing them a link. The researchers, from a firm called Claroc, said they pulled up loan applications, internal company financials, a bank fraud alert, and other sensitive material just by searching public internet records.

The problem traces back to how Muse builds the URLs it generates when a user shares a conversation. Most apps that let you share content this way create a link with a long, random string of characters that's effectively impossible to guess. Muse does something similar, but it also tucks the name of the conversation into the web address itself, as part of the subdomain rather than deeper in the URL path. That one decision turned out to be the flaw.

Here's why it matters: every time someone clicks a shared link, the domain name gets logged in what's known as passive DNS, a kind of historical record of internet traffic that tracks which domain names have resolved to which servers over time. Commercial services sell access to search these records. Because every Muse share link lives under the same domain, cf.metaaiusercontent.com, and because the conversation's title sits right there in the subdomain, anyone with access to a passive DNS search tool can simply look up what people have been naming their shared chats. Claroc gave simplified examples of what these addresses look like: things like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com or loan-application-draft-a4c9e2.cf.metaaiusercontent.com.

Using that method, Claroc said it enumerated 6,800 links that Muse users had created to share conversations. After opening a few hundred of them, the researchers turned up a batch of information that was clearly never meant to be public. Among their findings, according to the report: a job candidate's prep notes for a confidential executive-search call with a frontier AI lab, including the lab's internal contact and meeting time; a national marketing company's internal revenue review marked for its CEO; a small-business owner's loan application with the requested amount; a to-do list containing a bank fraud alert with a partial account number and transaction details; a real-estate investor's performance report listing two property addresses alongside exact return, income, and mortgage figures; and a company's full-year staff vacation calendar naming dozens of employees and their time off.

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query."

Claroc has a name for this kind of exposure: GhostShares, pages that open for people who were never sent the link and who found them entirely on their own. The firm's cofounder and CTO, Asaf Aprozper, said he reported the issue through Meta's bug bounty program on October 8 and separately tried reaching people at Meta on LinkedIn, but got no response through either channel.

Meta confirmed the behavior in response to questions from Ars Technica. "We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product," a company spokesperson said. "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

A pattern of security questions following a big launch

Muse launched to a strong reception, quickly climbing to one of the top spots in Apple's App Store. It's designed as a general-purpose agent that can autonomously fill out forms, book appointments, make purchases, and draft documents on a user's behalf. To do any of that, it needs access to most of a person's accounts, and Meta has leaned into that trust angle in its marketing. Mark Zuckerberg said last month that Muse was "built from the ground up for privacy and security."

This isn't the first security scrutiny Muse has faced. Three weeks after launch, macOS security researcher Patrick Wardle found a separate zero-day vulnerability that would have let any other app on the same device take complete control of a user's Muse account. Meta played down that finding, arguing exploitation required a device to already be compromised, and the company didn't address Wardle's point that a simple ClickFix attack, a technique that tricks users into running malicious commands, was enough to pull off the account takeover.

The discovery of GhostShares adds to that track record and raises a more pointed question: if a tool is asking for the kind of access Muse requires, how carefully should its guardrails be built before launch, not after researchers find the holes?

For now, the fix is a pause. Meta has suspended the sharing feature while it reviews the report and weighs changes to how the links are structured, and the company says that means Muse users are no longer exposed to this specific risk. What's not yet clear is whether Meta will overhaul the URL format itself, which would need to move the conversation title out of the discoverable subdomain, or whether a redesign is even enough on its own without also addressing how the links get indexed by outside DNS services in the first place.