Meta Muse exposes users' personal and business secrets when they share conversations

If you share conversations from Meta's Muse AI, your personal and business secrets are publicly discoverable. You must be aware of this risk and take precautions before sharing.

Meta's new AI agent, Muse, inadvertently exposes users' private and business information through easily discoverable shareable links. Researchers from Claroc discovered that by using a single query, they could access thousands of these links, which contained sensitive data. Examples include a confidential executive search candidate's notes, a company's internal revenue review, a small business loan application, a fraud alert with partial account numbers, a real estate investor's detailed financial reports, and an employee vacation calendar. These "GhostShares" occur because Muse constructs URLs that include the conversation title and a unique identifier, and the domain used is recorded in public DNS records. Claroc reported their findings to Meta, but stated the company did not reply, and Claroc believes this behavior is by design, urging users to be aware of the risks.

The security flaw in Meta Muse, dubbed "GhostShares," highlights a critical oversight in how AI agents handle shared data. By embedding conversation titles directly into shareable URLs and using a domain that is passively logged, Meta has created a mechanism for widespread, unintentional data leakage. This design choice undermines the privacy assurances Mark Zuckerberg stated for Muse, revealing that the "privacy and security" it was built with are compromised by a fundamental sharing feature. The ease with which Claroc could enumerate and access these sensitive conversations suggests a broader industry challenge in balancing AI functionality with robust data protection.

This incident raises serious questions about the security protocols of emerging AI agents that require extensive access to user accounts and data. The vulnerability, coupled with Meta's reported lack of response and downplaying of previous security issues, could significantly impact user trust and adoption of such tools. Companies relying on AI agents for sensitive tasks must now scrutinize not only the AI's capabilities but also the granular security of its sharing and data handling mechanisms. Future AI agent development will likely face increased pressure to prioritize security by design, potentially leading to more restrictive sharing options or enhanced end-to-end encryption for AI-generated content.