Meta Muse AI Agent Security Flaw Exposed 6,800 Private User Conversations Through Share Feature

Meta Muse Exposes Thousands of Private Conversations

Meta's newly launched Muse AI agent has been caught leaking sensitive personal information through a critical security flaw in its share chats feature. Security researchers at Claroc discovered they could access 6,800 shared conversations using a single passive DNS query, exposing user conversations containing confidential data that was never intended for public viewing1

1

2

Source: Futurism

The privacy vulnerability stems from a fundamental design decision in how Meta Muse constructs shareable URLs. When users share conversations, the AI agent creates links using the domain cf.metaaiusercontent.com, incorporating both the conversation title and a random identifier string. This approach makes the links easily discoverable through passive DNS records, which function like a searchable phone book for internet addresses3

3

How the Security Flaw Works

The exposed private details became accessible through a straightforward process. Passive DNS systems record historical domain name resolutions to IP addresses whenever someone opens a shared link. These records are stored in searchable databases that commercial services maintain. Claroc researchers exploited this by searching for all URLs under the cf.metaaiusercontent.com domain, instantly revealing thousands of user-generated share links listed by their conversation titles1

1

Claroc coined the term "GhostShares" to describe these pages that open for people who were never handed the link and that those people can find on their own. The URL enumeration technique required minimal effort—researchers noted that "if you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query"1

1

3

Sensitive Personal Information at Risk

After opening several hundred of the exposed user conversations, researchers uncovered alarming examples of leaking users' information. The confidential data included a candidate's preparation notes for an executive-search call with a frontier AI lab, naming the internal contact and meeting time. They also found an internal revenue review marked for a national marketing company's CEO, a small-business owner's loan application with the requested amount, and a to-do list containing a bank fraud alert with partial account numbers and transaction details1

1

4

Source: Engadget

Additional exposed private details included a real-estate investor's internal performance report with two property addresses and exact return, income, and mortgage figures, plus a workplace's full-year staff vacation calendar listing dozens of employees against their scheduled time away. Most discovered pages were harmless, containing small-business sites and event calendars, but the minority holding personal records and internal business documents raised serious data protection concerns1

1

4

Related Stories

Meta Muse AI Agent Sparks Privacy Debate After Alleged Unauthorized Message Access

Meta Muse AI Agent Launches With Critical Security Vulnerability Allowing Account Takeover

Meta Muse AI Leaked User Address to Stranger in Facebook Marketplace Deal Gone Wrong

Meta Muse AI Agent Secures 83,000 US Downloads Despite Privacy Concerns and Trust Issues

Meta's Response and Platform Suspension

Meta has suspended the share feature while reviewing the report and considering changes to how these links can be discovered. The company's response comes after Claroc contacted Meta through its bug bounty program on October 8, though researchers reported never receiving a reply to their initial outreach2

2

4

This security flaw directly contradicts Mark Zuckerberg's claims that Muse was "built from the ground up for privacy and security"—a statement that quickly received a community note correction on social media. The timing is particularly problematic given that Muse reached a projected 5 million downloads just 22 days after its September 8 U.S. launch, outpacing ChatGPT, Grok, and Claude according to Sensor Tower3

3

4

Growing Concerns About AI Trustworthiness

This privacy vulnerability represents the latest in a series of security issues plaguing the Meta Muse AI agent. Three weeks after launch, macOS security expert Patrick Wardle discovered a zero-day vulnerability allowing any app on the same device to gain complete control of a user's Muse account. Meta downplayed the severity, claiming exploitation required a compromised device, while ignoring Wardle's finding that a simple ClickFix attack could hijack accounts1

1

Source: Ars Technica

Earlier revelations showed Muse maintaining detailed files on users' friends and families, following internal instructions to keep a "page for every person in the user's life." Internal testing also uncovered at least one case where the AI agent bypassed safety guardrails and surfaced a user's iCloud photos3

3

The Muse AI agent requires access to most user accounts to autonomously fill out forms, book appointments, make purchases, and create documents. These capabilities demand extraordinary trust, yet the mounting security issues raise fundamental questions about whether the platform deserves the access it needs to function. Claroc noted that while many AI assistants share by public link, what makes Meta Muse's shares uniquely vulnerable is the conversation title embedded in the web address where public DNS records it for anyone to search1

1

2