Meta pauses Muse AI conversation sharing feature after researchers find over 6,800 discoverable links
Meta has paused the conversation sharing feature of its personal AI agent Muse, after security firm Claroc found that conversations shared via links could be found by people who did not receive the link. Claroc said Muse generated web addresses hosted under the cf.metaaiusercontent.com subdomain using the conversation title plus a random ID, and these addresses entered passive DNS databases, with a single query returning more than 6,800 shared hostnames. Most of the hundreds of pages Claroc accessed contained ordinary information, but some contained sensitive content such as confidential executive search call notes, small business loan applications, company revenue reviews and employee vacation schedules; Meta said it is reviewing the report.
Why read this
AI score 69
The way sharing links were generated allowed people without the link to find conversation pages, exposing privacy risks after the agent aggregated data across apps.
Topics
Body
The sharing feature in Meta’s Muse, its personal AI agent, has been paused after researchers at security firm Claroc found that conversations shared by link could be found even by people who had not been given the link. Claroc shared its detailed research on October 18. Meta then informed Ars Technica on October 20 that it had “paused this functionality while we review this report”.
Meta says Muse can connect to users’ email, calendar, payment, and health apps, as it is designed to act on their behalf. This means a shared conversation can contain far more information than a typical AI chatbot conversation. Although the pause has stopped access to these pages, Claroc claims that the titles of the shared conversations can still be found in commercial DNS databases.
Muse was launched in the US on September 8 for users aged 18 and above. MediaNama has earlier reported that Muse has been maintaining hourly updated profiles of users and the people mentioned in their conversations, as reported by TIME Magazine. After an Inc. columnist claimed that Muse had read his private messages, a claim Meta disputed, Apple announced stricter consent requirements for granting Mac apps full disk access.
How could people find links they were never sent?
When a user wanted to share a conversation, Muse would create a webpage containing it that anyone with the link could access without logging in. However, Claroc said the web addresses were generated using the conversation’s title and a random ID and were hosted on a subdomain of cf.metaaiusercontent.com. This made them discoverable through passive DNS databases. Claroc gave the illustrative example of home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.
When someone clicked on one of these links, their browser would look up the subdomain in the internet’s address book, known as the Domain Name System (DNS). These lookups are recorded and can be searched through passive DNS services. As a result, the full subdomain could end up in their databases.
A single query to a commercial passive DNS service returned more than 6,800 share hostnames, which could be converted back into working links, Claroc said. The firm calls these pages “GhostShares” because they can be opened by “people who were never handed the link”. Claroc noted that Muse had asked search engines not to crawl the shared pages, but Claroc did not need a search engine to find them.
What did the exposed pages contain?
Claroc accessed a few hundred pages. Most contained unremarkable information, such as event calendars and listings. However, some contained sensitive material, including:
A candidate’s notes for a confidential executive-search call that named an internal contact at an AI lab and included the meeting time.
A loan application by a small business owner that disclosed the amount requested, part of an account number, and a to-do list mentioning a bank fraud alert.
An internal revenue review prepared for the CEO of a national marketing company, alongside two property addresses and mortgage figures in a real estate investor’s report.
A workplace’s annual vacation calendar containing details of dozens of employees’ leave schedules.
Claroc did not contact the users or companies involved and has no evidence that anyone misused the shared information. The firm withheld all identifying information in its report and flagged the issue to Meta through its bug bounty programme on October 8. Asaf Aprozper told Ars Technica that he had also tried to contact Meta employees on LinkedIn but received no responses.
Pausing the feature only partially fixes the problem: On October 20, Claroc rechecked 40 previously accessed shares, none of which loaded. The hostnames serving the pages returned errors. However, before the pause was implemented, around 75 saved scans of Muse share pages had appeared on urlscan.io, a public URL-scanning service, Claroc found.
Responding to MediaNama’s questions, Claroc said content captured before the shutdown “may still exist in third-party archives, cached pages, or saved scans”, adding: “We haven’t verified whether any such copies remain publicly accessible. The important distinction is that disabling the original links doesn’t necessarily erase copies already collected elsewhere.”
Meta’s statement does not clarify whether the links have been permanently disabled or deleted, or whether the sharing feature will keep conversation titles out of web addresses when it is restored. Meta’s help page on sharing Meta AI conversations says that such links do not expire, but Claroc notes that this guidance is not specific to Muse.
What MediaNama has asked Meta
Whether the pause permanently disables existing share links, or only stops new ones from being created
Whether the shared conversations have been deleted from Meta’s servers, and how users can delete their own shares
Whether Meta will stop placing conversation titles in share-link addresses before it restores the feature
Whether Meta has notified users whose shared pages could be found this way
Whether Muse, or its sharing feature, was available to users in India, and whether any of the exposed shares belonged to users in India
This story will be updated when Meta responds.
Also read:
Meta launches Muse, an AI agent that acts across apps; India not in rollout
Report: How Meta’s Muse AI is building a detailed dossier on you using chats, emails, and relationships
[googlesitekit-end-of-content]
WP QUADS Content Ad Plugin v. 3.0.5.1
For You
Read Reasoned by Nikhil Pahwa: How AI is changing our world
Sponsor a MediaNama Event