Meta Suspends Muse AI Sharing After Researchers Find Sensitive Conversations

Meta has suspended a feature in Muse, its new general-purpose AI agent, after researchers found that shared conversation links could expose sensitive information. Meta said it is reviewing the feature and considering changes to how shared links are discovered.

Like many online services, Muse lets users share searches, conversations, images, and other content. The feature creates a unique URL that anyone with the link can use to view the shared page. These URLs typically contain long, difficult-to-guess sequences of text to prevent unintended access.

Researchers discovered thousands of Muse links

Muse appears to use similar safeguards, but researchers said design decisions involving its URLs made the links easier to discover. Security company Claroc reported that it was able to enumerate 6,800 links created by Muse users to share conversations.

After opening several hundred of the links, researchers found information that was clearly not intended for public release, including:

• Notes from a candidate preparing for a confidential executive search call with Frontier AI Labs, including the lab’s internal contact and meeting time.
• An internal revenue review for a national marketing company marked for CEOs.
• A loan application form for small and medium-sized business owners that indicated the requested amount.
• A to-do list containing bank fraud alerts, part of an account number, a transaction amount, and a time.
• An internal performance report for real estate investors that included the addresses of two properties and their income and mortgage figures.
• An employee vacation calendar listing dozens of employees and the weeks they would be absent.

“If you had asked us in advance, we would have guessed that it would take a lot of effort to collect these,” the researchers wrote. “It only took one inquiry.”

Meta pauses Muse sharing feature

In an emailed statement responding to questions from Ars, Meta said the Muse feature had been paused while the company reviews the report:

We launched the Muse bug bounty program to allow researchers to raise different scenarios and help us continually improve the product. Users can share specific Muse artifacts, creating a page that can be accessed by anyone with the link. However, this feature has been paused while we review this report and consider changes to how we discover these links.

Asaf Aprozper, Claroc’s co-founder and chief technology officer, said he reported the findings through Meta’s bug bounty program on October 8. He also tried to contact people at Meta through LinkedIn but did not receive a response either way.

How passive DNS exposed Muse URLs

Researchers said the easiest way to discover the shared URLs was through a passive DNS lookup using one of many commercial services. Passive DNS records store long-term information about domain resolutions, including IP addresses, name servers, and mail servers.

Passive DNS systems typically collect DNS responses from recursive DNS resolvers or other sensors in the infrastructure. When someone clicks a shared Muse link, the related DNS information can be recorded in a searchable database, making the URL easier to find.