Meta suspends Muse conversation sharing after researchers find thousands of exposed links

Meta paused the feature that lets users share Muse conversations by web link after security researchers reported that the links could be found by anyone. Ars Technica reported that the firm Claroc published its findings on Monday 19 October and that Meta, asked about them, said it had suspended sharing while it reviewed the report and considered changes.

The weakness was in how the addresses were built, according to Claroc as quoted by Ars. Each shared page lived on a subdomain of a single Meta domain, and the conversation’s title was part of the hostname, followed by a random string. Hostnames are recorded by passive DNS services, commercial databases that log domain lookups. Claroc said it could therefore list 6,800 shared conversations with a single query (“It took one query,” its researchers wrote), though the share URLs were meant to be known only to whoever received them. The firm called such pages “GhostShares”. After opening a few hundred, it said it found material not meant to be public: a confidential executive-search call preparation naming a frontier AI lab’s contact, a small-business loan application with the amount requested, a to-do list containing a bank fraud alert with part of an account number, and a staff vacation calendar listing dozens of employees.

Asaf Aprozper, Claroc’s co-founder and chief technology officer, told Ars he had reported the issue through Meta’s bug bounty programme on 8 October, and also tried contacting Meta staff on LinkedIn, without a reply. Meta said in a statement that it had opened the bounty programme so researchers could raise such scenarios. Ars noted that Meta chief executive Mark Zuckerberg had said in September that Muse was “built from the ground up for privacy and security”, and that security researcher Patrick Wardle had earlier reported a flaw that let another app on the same device take control of a Muse account. Ars said Meta downplayed that flaw’s severity because exploiting it required an already compromised device.

The episode bears on how much access a general-purpose agent can be trusted with. Muse, as Ars described it, fills in forms, makes purchases and creates documents, and needs access to most of a user’s accounts to do so. The sharing feature’s suspension removed this particular exposure; the hostnames already recorded in passive DNS history were not addressed in Ars’s report, and nothing in it said whether anyone had misused the links.