Meta re-enables Muse AI sharing feature following security fix for URL discovery

What happened

Meta has re-enabled the sharing feature for Muse, its general-purpose AI agent, after implementing a security fix [1]. The feature was previously paused after security researchers from the firm Claroc reported that public conversation links were easy to find [1, 2].

Key details regarding the security issue include:

• On October 8, Claroc cofounder and CTO Asaf Aprozper reported findings through Meta’s bug bounty program [2].
• Researchers at Claroc identified a design flaw where Muse shared “artifacts,” such as documents and images, used URLs that included the conversation title in the subdomain [1, 2].
• These links used the domain name cf.metaaiusercontent.com [2].
• Because the titles were in the subdomain, they were recorded in public DNS records, making them searchable via passive DNS services [2].
• Claroc researchers successfully enumerated 6,800 links and found sensitive information, such as a marketing company’s internal revenue review and a small business owner’s loan application [1, 2].
• Meta’s David Singleton stated on X that the underlying issue involved URLs for shared Muse artifacts rather than a flaw with chat sharing [1].
• As a result of the fix, all previously shared artifacts have been assigned new URLs [1].
• Users attempting to visit an old link will see a note requesting they obtain the new link from the owner [1].

Previously, Meta had suspended the functionality to review the report and consider changes to how links could be discovered [2]. This follows a separate incident three weeks after the Muse launch, when macOS security expert Patrick Wardle discovered a zero-day vulnerability that could potentially allow other apps on a device to gain control of a Muse account [2].

Who is affected

• Muse users who previously shared artifacts or conversations via web links are affected, as their old links no longer work [1].
• Developers and researchers interested in AI security can note the “GhostShares” method described by Claroc, where pages are found by people who were never intended to receive the link [2].
• Users of the Muse AI agent, which can autonomously fill out forms, book appointments, and make purchases, are the primary group whose data privacy was at risk [2].