Meta pauses Muse chat sharing after 6,800 links surface in DNS

Security firm Claroc says it enumerated 6,800 links that Muse users made to share conversations. The researchers opened a few hundred and found material that was clearly not meant to be public.

The pages Claroc described include:

• A job-hunting note: a candidate's preparation for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time.
• A revenue review: a national marketing company's internal report, marked for its CEO.
• A loan application: a small-business owner's request, with the amount.
• A bank alert: a to-do list with a fraud notice, a partial account number, and a transaction amount and time.
• An investor report: two property addresses with exact return, income and mortgage figures.
• A staff calendar: a full year of vacations, listing dozens of employees against the week each would be away.

Claroc's own summary was blunt. "If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query."

Most services let you turn a conversation into a web page. You click a share option, the service creates a unique address, and anyone with that address can open the page.

The safety comes from the address itself. It usually holds a long string of characters that nobody can guess, so only people you send it to can find it.

Ars Technica says Muse seems to take the same precaution. Muse's links do include a long string of text. The trouble is what sits next to it.

Two design choices added up, according to Ars Technica and Engadget. First, every Muse share link used the same domain name, cf.metaaiusercontent.com. Second, the conversation's title went into the subdomain, the part of the address before the domain.

Ars Technica gives simplified examples of how that looks:

• home-sale-budget-9f21c8a3.cf.metaaiusercontent.com
• q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com
• loan-application-draft-a4c9e2.cf.metaaiusercontent.com

A title in the path of a web address, after the domain, stays between your browser and the site. A title in the subdomain is different. It has to be looked up through the Domain Name System, the internet's phone book, and that lookup leaves a trace.

In real life Imagine mailing a letter in an envelope with the subject line written on the front, and the post office keeping a public list of every envelope it has seen. Nobody has opened your letter, but the list tells strangers it exists and what it is about.

Passive DNS records store how domain names resolved to IP addresses over time, along with nameserver and mail-server records. Monitoring systems usually collect them from sensors at DNS resolvers and other infrastructure.

Ars Technica explains that a record is generally created when a monitoring system sees a DNS response. Once the intended person clicks a Muse share link, the lookup is recorded in a searchable database. Many commercial services offer that kind of search.

Engadget puts it simply: passive DNS is like a phone book for the internet. Claroc compared the result to a table of contents.

"Muse names each share's web address after the conversation's own title, and that address is written into public DNS," Claroc explained in a blog post, as quoted by Engadget. "One passive-DNS search brings back thousands of them, listed by name."

No, and Claroc says so. "Plenty of AI assistants share by public link," the firm said. "What makes Muse's shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search."

Claroc calls the result GhostShares: pages that open for people who were never handed the link, and that those people can find on their own.

The flaw is not that Muse offers public links, but that the title in each address told the world what the page was about.

Meta told Ars Technica that it opened its Muse bug bounty program so researchers could raise different scenarios and help improve the product. It added that users can share specific Muse artifacts, which creates a page that anyone with the link can access.

"However, we've paused this functionality while we review this report and consider changes to how these links can be discovered," Meta said.

Claroc co-founder and CTO Asaf Aprozper says he reported the findings through the bug bounty program on October 8. He also tried to reach people at Meta on LinkedIn but got no reply either way, according to Ars Technica.

Engadget adds that Claroc's researchers could not open a sample of the links they had accessed earlier, after Meta's update.

Muse is not a plain chatbot. Ars Technica describes it as a general-purpose agent that fills out forms, books appointments, makes purchases and creates documents. To do that, it needs access to most of a user's accounts. You can read more about Meta's agent in our story on Muse Charm, and about the idea itself in our explainer on AI agents.

That access is why the content of shared chats can be so sensitive. People hand an agent the same things they hand an assistant: loan paperwork, bank alerts, calendars and internal reports.

Meta CEO Mark Zuckerberg said last month that Muse was "built from the ground up for privacy and security," Ars Technica notes. Meta has also marketed it as an agent worthy of the trust it needs.

Yes. Ars Technica says that three weeks after launch, macOS security expert Patrick Wardle found a zero-day vulnerability. It let any other app installed on the same device take complete control of a user's Muse account.

Meta played down the severity, arguing that exploitation was not possible unless the device was already compromised. Ars Technica says the company did not acknowledge Wardle's finding that a simple ClickFix attack was all it took to hijack an account.

The catch: that is a separate issue from the share links. Each report concerns a different part of the product.

• Think before you share: if you shared a Muse conversation by link, assume the page could have been seen by people you did not choose.
• Keep numbers out of chats you plan to share: account numbers, loan amounts and confidential names are the kind of details Claroc found.
• Sharing is paused for now: Meta has not said when it returns or what will change.
• Ask the same question of any assistant: does the share link hide the title, or put it in the address?