Meta has temporarily suspended the sharing feature for Muse, its new general-purpose AI agent, following reports that a design flaw allowed strangers to access private user conversations. Security researchers from the firm Claroc reported the vulnerability on Monday, prompting the company to halt the functionality while it reviews the issue.
The incident highlights a conflict between Meta’s marketing of Muse as a highly secure platform and the technical realities of how it handles user data. Meta CEO Mark Zuckerberg recently described the assistant as being “built from the ground up for privacy and security,” yet the specific way the company constructs share links made them easily discoverable by anyone with access to public DNS records.
How GhostShares Exposed Private Data
Claroc researchers identified 6,800 unique share links created by Muse users. By opening a few hundred of these links, they found content that was clearly intended to remain private. The vulnerability stems from how Meta generates URLs for shared conversations.
Typically, secure sharing features use long, random strings of text in URLs to prevent guessing. Muse links do include such strings, but they also place the conversation title directly in the subdomain. For example, a link might appear as home-sale-budget-9f21c8a3.cf.metaaiusercontent.com. This structure allows the conversation title to be indexed in passive DNS databases, which store historical records of domain name resolutions.
Researchers used commercial passive DNS services to search for these subdomains. Because the titles were visible in the address structure, anyone could search for specific keywords to find active share links. Claroc co-founder and CTO Asaf Aprozper noted that gathering this data required only a single query, rather than the significant effort usually needed to uncover such information.
The firm has coined the term “GhostShares” to describe these pages. They open for people who were never given the link and can be found independently by searching public records. Aprozper stated he reported the findings through Meta’s bug bounty program on October 8 but received no immediate response from the company.
Broader Security Concerns for AI Agents
This vulnerability adds to existing concerns about the security of AI assistants that require deep access to user accounts. Muse can autonomously fill out forms, book appointments, and make purchases, necessitating broad permissions. Three weeks after the launch of Muse, macOS security expert Patrick Wardle discovered a zero-day vulnerability that allowed other apps on a device to hijack Muse accounts.
Meta downplayed the severity of Wardle’s finding, arguing that exploitation required a compromised device. However, the ease with which share links can be discovered reinforces questions about whether the platform is worthy of the trust it demands from users. The company stated in an emailed response that it paused the sharing functionality to review the report and consider changes to link discoverability.
With the feature suspended, users can no longer generate new share links for Muse conversations. The company has not provided a timeline for when the feature will return or what specific technical changes will be implemented to prevent similar exposures in the future.
Source: Wired
