Researchers at security firm Claroc said Monday that they found 6,800 links to shared conversations from Meta’s Muse AI agent using a single passive DNS query. The links can open for people who were never given them, the researchers said.
Muse lets users share conversations through web links. Such links usually include a long string of text that is difficult to guess. Muse’s links do, too, but they also put the conversation title in the web address. All the links use the domain cf.metaaiusercontent.com.
Passive DNS services collect historical records of domain names and their associated network information. When someone opens a Muse share link, a monitoring system can record its DNS response in a searchable database. Claroc said the titles in Muse’s addresses made the links easy to find there.
Read nextAnthropic announces share commitment to public benefit fund“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.” Claroc calls the discoverable pages “GhostShares.”
Muse has broad access to personal accounts
The finding concerns an assistant that needs access to many of a user’s accounts to carry out tasks. Muse can fill out forms, book appointments, make purchases and create documents. Meta CEO Mark Zuckerberg said last month that Muse was “built from the ground up for privacy and security.”
The share-link finding follows another reported Muse security issue. Three weeks after the assistant launched, macOS security expert Patrick Wardle found a vulnerability that let another app on the same device take control of a user’s Muse account. Meta said exploitation required an already compromised device. Wardle said a ClickFix attack could be enough to hijack an account.
Claroc concluded the behavior was by design
A Meta representative did not immediately answer questions sent by email. Claroc co-founder and CTO Asaf Aprozper said his company contacted Meta but received no reply. He said Claroc concluded, after checking similar platforms and Muse documentation, that the share-link behavior was by design. Users can limit the personal information in conversations they share and delete share links as soon as possible.
