Muse, Meta’s new general-purpose AI agent, has been found to expose sensitive information when users share conversations via web links. In response to these findings, Meta has suspended the sharing feature while it reviews the design and considers necessary changes.

The Discovery of "GhostShares"

Researchers from the security firm Claroc discovered that the method Muse used to generate URLs for shared conversations made them easily discoverable by unauthorized parties. By performing passive DNS searches, the researchers enumerated 6,800 links created by Muse users.

Upon opening a few hundred of these links, they found information clearly not intended for public consumption, including:

  • Candidate notes for a confidential executive-search call with a frontier AI lab.
  • An internal revenue review for a national marketing company.
  • A small-business owner’s loan application, including the requested amount.
  • A to-do list featuring a bank fraud alert with a partial account number.
  • A workplace staff vacation calendar listing dozens of employees.

The Technical Flaw

The issue stems from a design decision to include the conversation title within the subdomain of the URL rather than the URL path. For example, a link might appear as loan-application-draft-a4c9e2.cf.metaaiusercontent.com. This structure allows passive DNS systems to observe and record the URLs in searchable databases the moment an intended recipient clicks the link.

“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”

Response and Previous Vulnerabilities

Despite Meta CEO Mark Zuckerberg’s claims that Muse was “built from the ground up for privacy and security,” this is the second major security concern identified since its launch. Three weeks ago, macOS security expert Patrick Wardle discovered a zero-day vulnerability that could allow other installed apps to gain complete control of a user’s Muse account.

Meta stated it has paused the sharing functionality while reviewing the report and considering changes to link discovery. The company emphasized that its bug bounty program is designed for researchers to raise such scenarios to improve the product.