Meta paused Muse sharing after 6,800 chats surfaced in public DNS

A sharing feature for an AI assistant turned into a public catalogue the moment somebody opened a share link. Meta paused the feature in its Muse assistant after security firm Claroc found 6,800 share links through passive DNS records, Ars Technica reported.

Dan Goodin at Ars Technica wrote that Claroc opened a few hundred of the discovered pages and found a candidate's notes for a confidential call with a frontier AI lab, a national marketing company's internal revenue review marked for its CEO, a small-business owner's loan application, a to-do list that included a bank fraud alert with a partial account number, a real-estate investor's performance report with property addresses and mortgage figures, and a workplace's full-year staff vacation calendar.

How the links were discovered

Muse builds each share's web address from the conversation's title plus a random string, served from subdomains of cf.metaaiusercontent.com. When the intended reader clicks the link, their browser looks up the hostname. Passive DNS providers record that lookup, which puts the hostname, title and random ID into a database anyone can query.

Claroc described the pattern as GhostShares. "Plenty of AI assistants share by public link," the firm said. "What makes Muse's shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search."

Asaf Aprozper, Claroc's co-founder and CTO, told Ars he reported the finding through Meta's bug bounty programme on 8 October and tried to reach people at Meta on LinkedIn. He got no reply through either channel.

Meta's response

Meta told Ars that it was suspending the sharing feature while it reviewed the report. Its emailed statement said people "have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Claroc rechecked 40 shares that had opened without an account earlier in the month. On the day Meta's response arrived, none of them opened.

The leak sits on top of a design decision Mark Zuckerberg described last month as "built from the ground up for privacy and security." Muse autonomously fills out forms, books appointments, makes purchases and creates documents, and needs access to most of a user's accounts to do so. A sharing bug that exposes the resulting conversations is a direct cost of that access.

The pattern is a warning for any team that lets users share links to an AI conversation. If the hostname carries anything a reader could guess at, a passive DNS provider logs it the first time somebody opens the share, and the random part of the URL is no longer secret. Keep the title in the URL path, not the subdomain, and treat every opened share as an advertised URL.

Source

Meta Muse exposes users' personal and business secrets when they share conversations by Dan Goodin at Ars Technica.