A share link is meant to give selected people access to a conversation. But researchers from security firm Claroc said they were able to find 6,800 links created by users of Meta’s Muse assistant, including pages containing information that did not appear intended for public access. Meta has paused the sharing feature while it reviews the findings.
How the links became discoverable
Muse lets users share searches, conversations, images, and other content through a web link. Such links can be opened by anyone who has them, so services commonly rely on long, hard-to-guess strings to make them difficult for others to find.
Claroc said Muse links used the domain name cf.metaaiusercontent.com and included the conversation title in a subdomain. That placement made the links discoverable through passive DNS searches, according to the researchers. Passive DNS systems record observed information about domain-name lookups over time, and those records can be searched.
The problem was not simply that a user could forward a link. Claroc said the title embedded in the web address, combined with public DNS records, made it possible to locate links without receiving them from the person who created them. The researchers called such pages “GhostShares”: pages accessible to people who were never given the link and could find it themselves.
What researchers found in shared conversations
After discovering the links, Claroc researchers said they opened a few hundred. They reported finding a range of material that appeared to be private, including business documents, personal financial details, and workplace information.
- A candidate’s notes for a confidential executive-search call with a frontier AI lab, including an internal contact and meeting time.
- A national marketing company’s internal revenue review marked for its CEO.
- A small-business owner’s loan application, including the requested amount.
- A to-do list mentioning a bank fraud alert, a partial account number, and a transaction amount and time.
- A real-estate investor’s internal performance report with property addresses and exact return, income, and mortgage figures.
- A workplace vacation calendar listing dozens of employees and the weeks they would be away.
The researchers described the ease of collection this way: “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”
Meta pauses sharing as it reviews the report
Asaf Aprozper, a cofounder and CTO of Claroc, said he reported the findings through Meta’s bug bounty program on October 8. He also tried to contact people at Meta on LinkedIn but received no reply either way, according to the article.
Meta said it opened the Muse bug bounty program so researchers could raise scenarios and help improve the product. In a statement to Ars, the company said users could share specific Muse artifacts through pages accessible to people with the link. It added that it had paused the functionality while it reviewed the report and considered changes to how links could be discovered.
That pause addresses the sharing feature described in the report while the review takes place. The article does not specify whether or when the feature might return, or what changes Meta may make.
Why link design matters for an AI assistant
Muse can fill out forms, book appointments, make purchases, create documents, and perform other actions autonomously. The article says the assistant requires access to most of a user’s accounts to work as intended, making the security of its features part of the broader question of how much trust it deserves.
The share-link report follows another security issue described in the article. Three weeks after Muse launched, macOS security expert Patrick Wardle discovered a zero-day vulnerability that allowed another app on the same device to gain complete control of a user’s Muse account. Meta said exploitation required a device to already be compromised. The company did not acknowledge Wardle’s finding that a simple ClickFix attack was enough to hijack an account.
With sharing suspended, Muse users no longer face this particular link-discovery threat, at least for now. The findings show why the details of link construction matter: a page may be intended for people with a link, yet information placed in a searchable address can make that link easier for others to uncover.