Meta Muse shared conversation links leak private data after passive DNS search
Researchers at Claroc reported Monday that Meta’s Muse AI agent can expose sensitive chat content when users share conversations through web links. Muse creates unique URLs for shared searches, chats, and images, but those addresses all sit on cf.metaaiusercontent.com and embed the conversation title plus a long string. Once an intended recipient opens a link, passive DNS services record the lookup. Because the title is in the hostname, a single commercial query was enough to enumerate 6,800 share URLs. After opening a few hundred, the researchers found material clearly not meant for the public, including personal and business secrets. They called these pages GhostShares: content anyone can find without being given the link.
Mark Zuckerberg said last month that Muse was “built from the ground up for privacy and security.” The assistant has risen near the top of Apple’s App Store and can fill forms, book appointments, make purchases, and create documents, which requires access to most of a user’s accounts. Three weeks after launch, macOS security expert Patrick Wardle found a zero-day that let any other app on the same device take full control of a Muse account. Meta downplayed it, arguing exploitation needed an already compromised device, and did not address Wardle’s finding that a simple ClickFix attack could hijack an account. Claroc co-founder and CTO Asaf Aprozper said the firm contacted Meta and got no reply; a Meta representative also did not immediately answer emailed questions. After comparing other platforms and Muse’s documentation, Aprozper concluded the discoverable links are by design. Users should limit personal details in shared chats and delete links as soon as possible.
Continue in the app — vote & join in ➔