Meta has suspended the sharing feature of Muse, its general-purpose AI agent, following a security report showing that users’ sensitive information becomes exposed when they share conversations through web links.
Researchers from security firm Claroc reported the vulnerability on Monday, stating that a central design decision in how Muse constructs share URLs made the links easy to discover and enumerate. According to the researchers, they were able to identify 6,800 links created by Muse users for sharing conversations, and after opening a few hundred, found information clearly not intended for public access.
Examples of exposed data included a candidate’s confidential executive-search notes naming an internal contact and meeting time, a national marketing company’s internal revenue review marked for its CEO, a small-business owner’s loan application with the requested amount, a to-do list containing a bank fraud alert with a partial account number, a real-estate investor’s performance report with property addresses and financial figures, and a workplace’s full-year staff vacation calendar listing dozens of employees.
“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the Claroc researchers wrote. “It took one query.”
The vulnerability exploits passive DNS searches, a technique using publicly available commercial DNS services that log historical domain name resolutions. When a user clicks a share link, DNS information is recorded in searchable databases, allowing researchers to discover the URLs without requiring direct access or hacking.
Asaf Aprozper, Claroc’s co-founder and CTO, reported the findings through Meta’s bug bounty program on October 8, and also attempted to contact Meta personnel on LinkedIn, but received no response through either channel before the public disclosure.
In response, Meta stated in an email to Ars Technica that it “opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product.” The company confirmed that users have the ability to share specific Muse artifacts, which creates a publicly accessible page, but noted it has “paused this functionality while we review this report and consider changes to how these links can be discovered.” Meta CEO Mark Zuckerberg had previously characterized Muse as “built from the ground up for privacy and security.”
Key facts
- Claroc researchers discovered they could enumerate 6,800 shared Muse conversation links using a single query
- Exposed data included confidential business information, loan applications, property details, and employee vacation schedules
- The vulnerability stems from how Muse constructs share URLs, making them discoverable through passive DNS searches
- Meta suspended the sharing feature while reviewing the report and considering design changes
- The researcher reported findings through Meta’s bug bounty program on October 8 with no initial response