Other discoveries included a workplace vacation schedule identifying dozens of employees and a personal task list referencing a bank fraud alert with partial account information.
The researchers traced the problem to how Muse generated URLs for shared conversations. Although the links contained randomized characters intended to make them difficult to predict, Meta also included conversation titles within their subdomains. That design made the addresses discoverable through passive DNS databases, which collect historical records of domain names and their associated network information.
Because Muse used the domain cf.metaaiusercontent.com for shared content, researchers could search DNS records for relevant subdomains and identify conversation links without knowing their randomized identifiers in advance.
Unlike conventional sharing links that place descriptive information elsewhere in the URL, Muse's approach exposed conversation titles to systems that record DNS activity. Once a recipient accessed a shared page, its domain information could become available through searchable DNS records.
Claroc named the issue GhostShares, describing a situation in which content intended for limited sharing could be discovered independently by outsiders.
“Plenty of AI assistants share by public link,” Claroc said. “What makes Muse’s shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search.”
The researchers said the discovery required surprisingly little effort, despite the seemingly unpredictable structure of the links.
Asaf Aprozper, Claroc's co-founder and chief technology officer, reported the findings to Meta through its bug bounty program on October 8. He also attempted to contact company representatives through LinkedIn but said he received no response through either channel.
After Ars Technica contacted Meta about the findings, the company confirmed it had suspended the sharing functionality while investigating the report.
“We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product,” Meta said in an emailed statement. The company added that it was reviewing how shared links could be discovered and considering potential changes.
The disclosure raises additional privacy questions for Muse, which Meta has promoted as an AI assistant capable of completing tasks across users' digital accounts. The product can handle activities such as booking appointments, filling out forms, making purchases and creating documents, capabilities that require access to potentially sensitive personal and business information.
Meta CEO Mark Zuckerberg described Muse last month as “built from the ground up for privacy and security,” emphasizing the company's approach to protecting user information.
The sharing issue follows an earlier security finding involving Muse's macOS application. Three weeks after the assistant's introduction, security researcher Patrick Wardle identified a zero-day vulnerability that could allow another application running on the same computer to take control of a user's Muse account.
Meta argued that exploiting the flaw required an already compromised device. Wardle, however, demonstrated that a ClickFix attack could provide a route to account takeover.
The two findings involve different security weaknesses. The earlier vulnerability concerned unauthorized account access, while Claroc's research demonstrated how information deliberately shared through Muse could become discoverable beyond its intended audience.
Meta's decision to suspend conversation sharing removes the immediate exposure route identified by Claroc, although the company has not specified when the feature might return or what technical changes it plans to implement.
This analysis is based on reporting from ars TECHNICA.
Image courtesy of Samuel Boivin/NurPhoto.
This article was generated with AI assistance and reviewed for accuracy and quality.
