A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
Meta's AI agent, Muse, had a design flaw in its share links that allowed researchers to easily discover and access users' private conversations, exposing sensitive personal and business information.
Intelligence analysis by Gemini 2.5 Flash
Security researchers from Claroc discovered that Muse's share links, intended for private sharing, were publicly discoverable due to conversation titles being embedded in subdomains. This design choice allowed them to enumerate thousands of links and access confidential user data, prompting Meta to suspend the sharing feature.
Imagine you write a secret message on a special paper, and when you share it with a friend, the paper automatically writes the message's title on the outside of the envelope. Even if the envelope has a secret code, anyone who knows where to look for envelopes could easily read the title and guess what's inside, even if they weren't meant to see it. That's what happened with Meta's AI helper, Muse, letting people accidentally see private chats.
Analysis
The recent discovery of a critical design flaw in Meta's AI agent, Muse, has brought to light serious privacy vulnerabilities. Researchers from the security firm Claroc identified that the method Muse used to generate shareable links made private conversations publicly discoverable. This was not a brute-force guessing attack, but rather a structural flaw where conversation titles were incorporated into the subdomain of the URL, making them visible in passive DNS records.
Claroc
Claroc, the security firm behind the discovery, reported that they were able to enumerate thousands of Muse share links with surprising ease. Their findings revealed that the design decision to place conversation titles within the subdomain, rather than the URL path, was the critical misstep. This allowed anyone with access to passive DNS search services to uncover links that were intended for private sharing, effectively bypassing the long, unguessable strings typically used to secure such URLs.
The researchers were able to access a wide array of sensitive information, demonstrating the severity of the flaw. This included confidential executive-search call notes, internal company revenue reviews, personal loan applications, bank fraud alerts with partial account numbers, and even full-year staff vacation calendars. The ease with which this data was accessed, described by Claroc as taking "one query," underscores a fundamental oversight in Muse's privacy architecture.
6,800 links
Claroc researchers successfully enumerated 6,800 links that Muse users had created for sharing conversations. This substantial number indicates the widespread potential for data exposure, affecting a significant portion of users who utilized the sharing feature. The sheer volume of discoverable links highlights the scale of the vulnerability and the potential for unauthorized access to private data.
Upon reviewing a few hundred of these links, the researchers found a trove of information that was clearly not meant for public consumption. The types of data exposed ranged from financial details and business strategies to personal schedules and sensitive to-do lists. This incident raises serious questions about the 'built from the ground up for privacy and security' claim made by Meta CEO Mark Zuckerberg regarding Muse.
GhostShares
Claroc coined the term "GhostShares" to describe these publicly discoverable pages. The term aptly captures the essence of the vulnerability: content that appears to be privately shared but can be found by unintended parties without ever being explicitly handed the link. This concept differentiates Muse's flaw from typical link-sharing mechanisms, where the obscurity of a long URL is the primary security measure.
Meta has responded by suspending the sharing functionality while it reviews the report and considers changes. This action, while necessary, comes after Muse had already gained significant traction, reaching top spots in app stores. The incident follows a previous zero-day vulnerability discovered by macOS security expert Patrick Wardle, further compounding concerns about Muse's overall security posture and its suitability for handling the extraordinary trust it demands from users.
Key points
- Meta's AI agent, Muse, had a design flaw in its share links that exposed users' private conversations.
- Security firm Claroc discovered the flaw, finding that conversation titles embedded in subdomains made links publicly discoverable via passive DNS.
- Researchers enumerated 6,800 links, accessing sensitive data like financial records, business plans, and personal schedules.
- Meta has suspended the sharing functionality of Muse to review the issue and implement changes.
- This is the second significant security concern for Muse, raising questions about its privacy and security claims.
Meta's swift action to suspend the sharing feature demonstrates a commitment to addressing security flaws once identified. This responsiveness suggests that the company is taking user privacy seriously and will likely implement more robust security measures for its AI products going forward.
This incident marks another significant security vulnerability for Meta's Muse, following a previous zero-day exploit. It raises serious doubts about the AI agent's overall security design and Meta's ability to protect the highly sensitive data that Muse requires to function, potentially eroding user trust.
