AI Briefing
KOSign in

Meta suspends Muse sharing feature after researchers expose 6,800 private conversation links

·2026.10.20 21:33

Key point

Security firm Claroc enumerated 6,800 private Muse share links via passive DNS, prompting Meta to pause the feature while it reviews the vulnerability.

Details

  • Meta has suspended the conversation sharing feature in its Muse AI agent after researchers from Claroc demonstrated that private links could be easily discovered and accessed by unauthorized users.
  • Claroc enumerated 6,800 share links using passive DNS searches, revealing sensitive data such as executive search notes, internal revenue reviews, loan applications, and staff vacation calendars.
  • The vulnerability stems from Muse placing conversation titles in the subdomain of the share URL (e.g., home-sale-budget-9f21c8a3.cf.metaaiusercontent.com), allowing the links to be indexed in public DNS records.
  • Meta stated it paused the functionality to review the report and consider changes to how links are discovered, following a bug bounty report submitted on October 8.
privacyvulnerabilitymetaai-securitydnsmuse
Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.

Related

RedditMeta Fixes Muse AI Agent Vulnerability Allowing Access to Internal DatabasesRedditMeta Defends Muse AI Agent's Adult Content Generation as Legal in Private VMsHacker NewsTIME Investigation Reveals Meta’s Muse AI Agent Builds Detailed User DossiersTLDR AIMeta May Never Need Ads in Muse Due to Indirect Monetization LoopGeekNewsMeta revises commercial terms to remove 'train' but retains broad scraping rights for AI business productsMeta EngineeringMeta Details AI-Native Engineering Approach Used to Build Forum App