Meta suspended a sharing feature in its Muse AI assistant after security researchers discovered a flaw exposing thousands of private user conversations.
Discovery of Exposed Share Links
The issue stems from how Meta structured the web links generated when users shared content from Muse. Like many conversational artificial intelligence platforms, Muse allowed individuals to generate public links to share chats, search results, images, and other created assets. To protect user privacy, web services typically create randomized text strings in link paths that cannot easily be guessed by unauthorized parties.
However, researchers from the cybersecurity firm Claroc discovered that Meta placed the titles of shared conversations directly inside the subdomain structure of the address rather than in the URL path. All generated links used the main domain cf.metaaiusercontent.com, with specific titles appended to the front. Examples of these simplified web addresses included home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, and loan-application-draft-a4c9e2.cf.metaaiusercontent.com.
Because the conversation title was located within the subdomain, any attempt to visit the link caused standard domain name system resolvers to log the full address in commercial passive DNS databases. These public databases collect historical records of internet domain queries. As a result, anyone with access to commercial passive DNS search tools could query the domain and instantly reveal active links without needing to guess them.
Thousands of Links Harvested in One Query
Claroc reported that its security researchers were able to aggregate 6,800 distinct Muse sharing links with a single query. Upon examining a sample of several hundred resolved pages, the researchers found personal and business information that users had clearly not intended to make public. Claroc labeled these discovered URLs GhostShares, describing them as accessible web pages that could be located independently by individuals who were never directly sent the original link.
Asaf Aprozper, co-founder and chief technology officer at Claroc, stated that he submitted the research to Meta through its official bug bounty program on October 8. Aprozper also attempted to contact company representatives through LinkedIn, but received no initial response through either channel.
In a statement sent by email to Ars Technica, Meta confirmed that it had paused the sharing capability while conducting a security review. Meta indicated that the bug bounty program was designed to identify such scenarios and stated that it is considering modifications to how shareable links are structured and discovered in the future.
Security Concerns Surrounding Meta Muse
The privacy vulnerability comes shortly after Meta CEO Mark Zuckerberg described Muse as being engineered with a primary focus on security and privacy. The general-purpose AI agent quickly climbed to top positions on the Apple App Store due to its ability to perform autonomous actions on behalf of users. To carry out tasks such as filling out online forms, booking calendar appointments, making financial transactions, and generating documents, Muse requires broad permissions across user accounts.
This is not the first security issue to surface regarding the assistant. Only three weeks after the public release of Muse, macOS security researcher Patrick Wardle reported a zero-day vulnerability. That flaw permitted any application installed locally on a device to gain full control of a user's Muse account. At the time, Meta downplayed the severity of the report, noting that exploitation required a device to be previously compromised, though the company did not address Wardle's demonstration that a basic ClickFix technique could execute the attack.
What This Means
The discovery of exposed conversation links highlights the inherent privacy challenges involved in deploying autonomous AI agents. When an AI tool requires extensive access to sensitive personal and professional accounts to perform automated tasks, any flaw in its web architecture can lead to significant data exposure. While generating shareable links is a common feature across modern generative tools, embedding contextual user metadata into DNS-queryable subdomains creates an unexpected attack vector that passive monitoring tools can easily index.
For Meta, this incident reinforces the ongoing scrutiny surrounding its security claims. Pausing the share feature prevents further link scraping for now, but it also underscores the delicate balance tech companies must strike between feature convenience and user confidentiality. As AI agents handle increasingly sensitive financial, professional, and personal workflows, security practices at every level of infrastructure, including basic web address design, remain critical to maintaining user trust.
Illustration: AI-generated image, not a photograph of the event.