Meta Muse exposes users' personal and business secrets in shared conversations

Meta’s Muse AI exposed sensitive personal and business data through its conversation-sharing links because of a flawed URL design. Security researchers at Claroc were able to enumerate roughly 6,800 shared links and, after opening a few hundred, found confidential items such as an executive-search candidate’s prep notes with internal contact and meeting time, a marketing firm’s internal revenue review for its CEO, a small business owner’s loan application with requested amount, a bank-fraud alert with partial account details and transaction timing, a real-estate investor’s performance report with addresses and exact financials, and a workplace vacation calendar listing dozens of employees. Researchers coined the term GhostShares for pages that anyone can discover and open without being given the link.

The links were discoverable because Muse places the conversation title inside a subdomain on a single domain (cf.metaaiusercontent.com), and passive DNS services record those subdomains when someone clicks them. Claroc used that passive DNS data to find the pages with a single query. Meta paused the sharing feature while reviewing the problem and highlighted its bug-bounty program; Muse had already faced an unrelated macOS zero-day that let other apps hijack accounts, raising broader questions about whether the assistant deserves the wide access it requests.