Meta Pauses Muse Sharing After 6,800 Links Were Discovered
Meta pauses Muse conversation sharing after researchers found 6,800 discoverable links exposing confidential business, banking, property and staff data.
Summary
Security firm Claroc enumerated 6,800 user-created Meta Muse sharing links with one passive DNS query, then opened several hundred. Exposed material included confidential executive-search notes naming a frontier AI lab contact and meeting time, a national marketing company’s CEO revenue review, a small-business loan amount, a bank fraud alert with a partial account number plus transaction amount and time, two property addresses with exact return, income and mortgage figures, and a full-year calendar showing dozens of employees’ vacation weeks.
Muse links all used cf.metaaiusercontent.com and placed the conversation title beside a long random string. Once an intended recipient opened a link, passive DNS systems could record the address, making descriptive titles searchable by people who never received it. Meta paused sharing on October 20, 2026, hours after the disclosure, while reviewing the findings and possible changes. It said shared artifacts were accessible to anyone with the link and cited Muse’s bug bounty program.
Muse rapidly reached a top position in Apple’s App Store. It autonomously fills forms, books appointments, makes purchases and creates documents, requiring access to most user accounts. Mark Zuckerberg said last month that Muse was designed around privacy and security. Three weeks after launch, macOS researcher Patrick Wardle found a zero-day allowing another installed app to control a user’s Muse account. Meta said exploitation required an already compromised device, while Wardle found a ClickFix attack could hijack an account. Suspending sharing removes the newly identified exposure for now.
Positives
- Meta paused Muse sharing on October 20, 2026, while reviewing Claroc’s findings and possible link-discovery changes.
- Muse’s bug bounty program gives security researchers a formal channel for reporting vulnerabilities and dangerous design scenarios.
- Suspending shared links removes the passive DNS discovery threat for Muse users while Meta assesses a permanent response.
Risks & concerns
- Claroc enumerated 6,800 Muse sharing links with a single passive DNS query and accessed several hundred pages.
- Exposed links contained executive-search notes, revenue data, loan details, banking information, property finances and employee vacation schedules.
- Conversation titles embedded in cf.metaaiusercontent.com addresses made supposedly hard-to-guess links searchable after passive DNS systems recorded them.
- Muse requires access to most user accounts while autonomously completing forms, appointments, purchases and document creation.
- Patrick Wardle’s earlier zero-day let another installed macOS app control Muse, with a ClickFix attack potentially sufficient for account hijacking.