Meta's Muse Exposes 6,800 Shared Chat Links via Guessable URLs
Updated
Updated · Ars Technica · Oct 20
Meta's Muse Exposes 6,800 Shared Chat Links via Guessable URLs
3 articles · Updated · Ars Technica · Oct 20
Summary
Researchers at Claroc found 6,800 shareable Muse conversation links and, after opening a few hundred, uncovered sensitive business and personal data that appeared unintended for public access.
A single passive DNS query surfaced the links because Muse puts conversation titles into subdomains under cf.metaaiusercontent.com, making URLs far easier to discover than random long strings alone.
Exposed material included executive-search notes naming an AI lab contact, a CEO-marked revenue review, a loan application amount, a bank-fraud alert with partial account details, and a staff vacation calendar.
The findings undercut Meta CEO Mark Zuckerberg's statement last month that Muse was built "from the ground up for privacy and security," raising broader concerns about how AI sharing features handle sensitive data.