Essential Insights
- Muse share links were discoverable through public passive-DNS databases—researchers said it took just one query.
- The URL design exposed conversation titles: placing them in subdomains made links searchable, even by people never given them.
- Meta paused link sharing while reviewing the report; researcher Asaf Aprozper said he reported the issue on October 8.
- The finding raises trust concerns: Muse can access sensitive accounts, and a separate previously reported flaw also put user accounts at risk.
A Share Link With a Searchable Trail
Meta Muse lets users share specific AI-created pages through links. But Claroc researchers found that the links could be discovered without receiving them directly. Muse placed conversation titles in web addresses under a shared Meta domain. Once someone opened a link, public DNS records could help others find it.
The researchers said one search query uncovered links. That does not mean every Muse conversation became public. Still, anyone who found a link could open its page, raising a clear privacy concern.
Meta Pauses the Feature
Meta said users could share selected Muse artifacts with anyone who had the link. After the report, the company paused sharing while it reviews how people can discover those links.
The feature offered a simple way to pass along useful work. Yet the address design created risk: conversation titles such as “loan application draft” could appear in searchable records. Claroc calls these discoverable pages “GhostShares.” The label captures the concern, though the underlying issue is straightforward: a link meant for one person may reach others.
Convenience Must Earn Trust
Muse has quickly gained popularity. It can fill out forms, book appointments, make purchases and create documents. Those abilities require access to users’ accounts, so people need strong reasons to trust the assistant.
A separate security flaw reported after Muse’s launch adds to that scrutiny. Meta said exploitation required an already compromised device, while researcher Patrick Wardle argued that a common scam technique could enable an account takeover.
For now, Meta’s pause removes this particular sharing risk. The broader lesson is positive but practical: useful AI tools can grow adoption when companies make sharing easy—and protect private information just as carefully.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
AITechV1
