Meta's Muse, a general-purpose AI agent designed to perform tasks like booking appointments and managing calendars, has faced scrutiny over a privacy flaw in its conversation-sharing feature. While Meta marketed the assistant as being "built from the ground up for privacy and security," researchers from the security firm Claroc found that the way Muse constructs shareable URLs makes it possible for unauthorized parties to discover and access private conversations.
The article introduces Meta's Muse as a general-purpose AI agent designed for task management and personal assistance.
The text discusses Meta's marketing claims regarding the privacy and security architecture of the Muse assistant.
The vulnerability stems from a specific architectural choice: Muse includes the conversation's title directly within the subdomain of the URL. For example, a link might appear as `loan-application-draft-a4c9e2.cf.metaaiusercontent.com`. Because these subdomains are registered on a public domain, they are recorded in passive DNS systems—databases that store historical DNS resolutions. Researchers were able to use a single query to enumerate 6,800 such links, uncovering sensitive data including confidential executive-search notes, internal revenue reviews, loan applications, and real-estate performance reports.
In response to the findings, Meta stated it has suspended the sharing functionality while it reviews the report and considers changes to how these links are discovered. The incident has raised questions regarding the security of AI agents that require deep access to a user's personal accounts and data. While the current threat is mitigated by the feature's suspension, the flaw highlights a significant trade-off between ease of sharing and the security of information stored in subdomain names, which are inherently more visible to public monitoring tools than standard URL paths.
Claroc researchers characterized these as "GhostShares"—pages that remain accessible to anyone who can find the URL, even if the intended recipient was never provided with the link. The discovery underscores a recurring challenge in AI development: ensuring that convenience features, such as one-click sharing, do not inadvertently bypass the very privacy protections the platform promises to provide. Until Meta implements a more opaque method for generating unique identifiers, the risk of public discovery remains a primary concern for users of the platform.
This issue is compounded by previous security concerns regarding Muse. Shortly after its launch, a zero-day vulnerability was discovered that could allow other apps on a device to gain control of a user's Muse account. While Meta downplayed the severity of that specific bug, the ease with which share links can be discovered adds to the ongoing debate over whether the assistant's high level of system access is balanced by sufficient security measures.
Currently, the primary mechanism for discovery is passive DNS searching through commercial services. By moving the conversation title from the URL path to the subdomain, Muse inadvertently made its private content searchable by any entity monitoring DNS traffic. Meta's move to pause the feature suggests that a redesign of the URL structure—likely moving toward long, non-guessable strings that do not include descriptive titles—is necessary to restore the privacy of user conversations.
Ultimately, the incident serves as a reminder that even when an AI agent is designed with privacy as a core pillar, specific implementation details like DNS architecture can create unintended backdoors. For users, the immediate takeaway is that any content shared via Muse links may be visible to anyone who can query public DNS records, a risk that Meta is currently addressing by disabling the feature entirely.