Meta’s personal AI assistant, Muse, has been found to pose a significant privacy risk. Cybersecurity research team Claroc revealed in a report on October 18th that over 6,800 domain names for Muse conversation sharing pages were discoverable through Passive DNS queries. Alarmingly, some of these exposed pages contained sensitive personal financial information, internal company documents, and confidential meeting preparation materials.
How the Vulnerability Was Discovered
According to Claroc’s findings, Muse generates web addresses for shared conversations based on the user’s provided title for the chat. These addresses were deployed under the cf.metaaiusercontent.com domain. The critical issue arose because the conversation title was embedded directly into the subdomain of these URLs. When users or recipients accessed these shared pages, the related domain names could be recorded by Passive DNS services. This meant that historical DNS databases, which are publicly queryable, could then reveal these links.
Researchers from Claroc were able to identify more than 6,800 hostnames for these shared pages with just a single Passive DNS query. A subsequent review of several hundred of these pages uncovered a disturbing array of sensitive content. Examples included documents related to corporate revenue reviews, applications for small business loans, bank fraud alerts, real estate investment data, and even annual employee leave schedules.
In one particularly concerning instance, researchers found materials prepared by a job candidate for a confidential call with the head of a cutting-edge AI lab. This preparation included internal contact information and meeting timings, highlighting the deeply personal and potentially damaging nature of the exposed data.
No Account Login Required
A key aspect of this vulnerability was that these shared pages did not require a Meta account login to access. Anyone possessing the correct link could view the content. The problem wasn’t attributed to attackers cracking random identifiers, but rather to the fact that the full domain, including the title-based subdomain, was logged in Passive DNS databases, allowing researchers to rediscover these sharing addresses through standard queries.
Meta’s Response and Actions
Claroc reported the issue to Meta through the company’s bug bounty program on October 8th. A Meta spokesperson acknowledged that users could share specific Muse content, generating pages accessible via a link. In response to the findings, Meta has since suspended the sharing functionality. The company stated that it is currently reviewing the research report and evaluating potential solutions to enhance link discoverability controls.
Current Status and Lingering Concerns
In an update to their report on October 20th, Claroc indicated that their research team re-examined 40 of the previously accessible, non-login sharing pages. These pages were no longer accessible, with their respective hostnames now returning errors. However, the researchers noted that domain names and their associated conversation titles that have already been logged in Passive DNS historical records still exist. The suspension of the sharing feature, therefore, does not completely erase these past records.
Claroc also emphasized that their investigation was limited to a specific domain pattern and a single discovery channel. This means the full scope of exposed content across all Muse sharing features cannot be definitively determined from this study alone. The research team stated there is no evidence that these pages have been maliciously exploited, nor is it possible to ascertain if others accessed this content before the researchers’ discovery.
This incident underscores the ongoing challenges in balancing AI assistant functionality with robust privacy protections, especially when user-generated content is made shareable.
