Digital Event Horizon
Meta Muse, a new AI agent, has been found to expose sensitive information when users share conversations through its share feature. Researchers have discovered thousands of URLs that contain confidential information, raising concerns about the security of the service. With its innovative features and capabilities, Muse has sparked both excitement and concern among users and developers alike.
Meta Muse's share feature allows users to share conversations with others through a unique URL.The URL design decision reveals sensitive information not intended to be publicly available.The inclusion of the conversation title in the URL makes it easily discoverable using passive DNS records.The discovery has raised concerns about the security of Muse and potential exposure of sensitive information.Meta has not provided an immediate response to questions about the issue.The discovery highlights the importance of careful design and consideration of potential security risks in AI-powered services.
Meta Muse, the new general-purpose AI agent from Meta, has been making headlines for its innovative features and capabilities. However, a recent discovery by researchers at security firm Claroc has shed light on a potential security threat lurking beneath the surface of Muse's design. According to the researchers, Muse's share feature allows users to share conversations with others through a unique URL, which can be easily discovered using passive DNS records.
The URL design decision made by Meta has made it possible for researchers to enumerate thousands of links created by Muse users, revealing sensitive information that was not intended to be publicly available. The researchers found examples of confidential executive-search calls, internal revenue reviews, loan applications, and to-do lists that contained sensitive information, such as partial account numbers, transaction amounts, and property addresses.
The ease of discovery of these links is attributed to the inclusion of the conversation title in the URL, which can be easily searched using passive DNS records. This has led to the creation of "GhostShares," pages that open for people who were never handed the link, and can be found on their own.
The discovery has raised concerns about the security of Muse and the potential for sensitive information to be exposed. The researchers, led by Claroc co-founder and CTO Asaf Aprozper, have emphasized that this behavior is by design, but users should be aware of the potential risks and take necessary precautions to protect their sensitive information.
In response to the discovery, Meta has not provided an immediate response to questions sent by email, leaving users to wonder about the company's stance on the issue. The ease of discovery of these links has raised questions about the need for more stringent security measures to protect user data.
The discovery of this vulnerability highlights the importance of careful design and consideration of potential security risks in the development of AI-powered services. As AI continues to become increasingly pervasive in our lives, it is essential that developers prioritize user security and privacy.
Related Information:
https://www.digitaleventhorizon.com/articles/Meta-Muses-Hidden-Vulnerability-A-Security-Threat-in-the-Making-deh.shtml
https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/
Published: Tue Oct 20 08:34:12 2026 by llama3.2 3B Q4_K_M
