Meta pauses Muse conversation sharing after researchers enumerate 6,800 private links

Meta pauses Muse link sharing after privacy exposure

Meta has suspended the conversation-sharing feature of Muse, its general-purpose AI agent, after security researchers demonstrated that links intended to share conversations privately could be discovered with almost no effort, exposing sensitive personal and business information. The company confirmed the suspension in a statement to Ars Technica, which reported the findings on Monday.

What the researchers found

Researchers at security firm Claroc said they were able to enumerate 6,800 links that Muse users had generated to share conversations with others. Share features of this kind typically work by creating a unique URL that loads a page hosting the content, and their security rests on the assumption that the URL contains enough unguessable text that no unintended party can find it.

According to Ars Technica, that assumption did not hold for Muse due to a central design decision in how the URLs are constructed. After opening a few hundred of the links, the researchers documented material clearly not meant for public view, including a candidate's preparation notes for a confidential executive-search call with a frontier AI lab, a national marketing company's internal revenue review marked for its CEO, a small-business owner's loan application with the amount requested, a to-do list containing a bank fraud alert with a partial account number and transaction details, a real-estate investor's internal performance report listing property addresses and exact financial figures, and a workplace's full-year staff vacation calendar naming dozens of employees and their scheduled time off.

The researchers wrote that they had expected harvesting such links to require real effort. In their words, "It took one query."

How the links were discoverable

The easiest route to the URLs, Ars Technica reports, is a passive DNS search through any of several commercial services. Passive DNS databases record the historical resolution of domain names to IP addresses, along with nameserver and mail-server records, using data collected from sensors at recursive resolvers and other infrastructure. When an intended recipient clicks a share link, the resulting DNS resolution is recorded in a searchable database. Combined with Muse's URL construction, this gave the researchers a practical way to enumerate valid share links at scale.

Meta's response

In a statement emailed to Ars Technica, Meta said it had opened the Muse bug bounty program so researchers could raise different scenarios and help improve the product, and confirmed it had paused the sharing functionality "while we review this report and consider changes to how these links can be discovered."

Asaf Aprozper, co-founder and CTO of Claroc, told Ars Technica that he submitted the findings through Meta's bug bounty program on October 8 and also tried reaching Meta staff on LinkedIn, but received no reply through either channel. Meta's suspension came only after Ars Technica contacted the company with questions about the behavior.

The timing is awkward for Meta. CEO Mark Zuckerberg had said just last month that Muse was "built from the ground up for privacy and security," a claim the reported findings appear to contradict.

Why it matters

General-purpose AI agents like Muse are designed to be confided in: users paste in loan documents, revenue figures, calendars and personal plans because that is precisely what the agents are for. A sharing mechanism that leaks those conversations turns a convenience feature into a privacy incident affecting everyone who used it.

The discovery technique also matters well beyond Meta. The security of "anyone with the link" sharing depends entirely on URLs being unguessable, and passive DNS has now been shown to be a workable side channel for discovering such links at scale. Any service that builds share URLs from predictable components, and whose links resolve through ordinary DNS, may carry the same exposure, and because the collection happens outside the target's infrastructure, it leaves no trace on the service's own servers.

Finally, the disclosure timeline raises process questions. A bug bounty report submitted on October 8 went publicly unanswered until a news outlet pressed the company nearly two weeks later, suggesting that bounty programs only protect users if vendors actually act on what researchers send them.