Meta pauses Muse sharing feature over exposure risk for personal and business data

Traders Union
All News
Business & Wealth
Companies
Meta pauses Muse sharing feature

Highlights

Claroc researchers found Meta's Muse sharing system exposed sensitive content by incorporating conversation titles in subdomains, making 6,800 share links easily discoverable through passive DNS records.
Exposed materials included confidential executive-search notes, internal revenue reviews, loan applications, and bank fraud alerts, raising business and personal privacy concerns.
Meta has paused Muse's sharing feature and is reviewing privacy controls after being notified of the flaw via Claroc's bug bounty submission on October 8.

Muse link design exposes sensitive content

As first reported by Ars Technica, researchers at security firm Claroc say Meta's Muse sharing system makes it possible to discover conversation links through passive DNS records, rather than only through direct sharing between users.

Muse lets users create web links for searches, conversations, images and other content, using a format intended to be accessible to anyone with the link. While such systems typically rely on hard-to-guess addresses to limit unintended access, Claroc says Muse includes the conversation title in the subdomain, making those links far easier to find through searchable DNS data.

The researchers say they were able to enumerate 6,800 Muse share links and reviewed a few hundred of them. Among the materials they found were notes for a confidential executive-search call, a marketing company's internal revenue review, a small-business loan application, a to-do list referencing a bank fraud alert, a real-estate performance report and a workplace vacation calendar.

Claroc says the exposure stems from Meta's decision to place the conversation name in the web address itself, rather than in the URL path. The firm describes the pages as "GhostShares," meaning content that can be opened by people who were never directly given the link but can find it independently.

Meta review and wider privacy implications

Meta says it is pausing the functionality while it reviews the report and considers changes to how the links can be discovered. In an emailed statement cited in the report, the company says users have the ability to share specific Muse artifacts, but it is now reassessing that feature after the researchers' findings.

Asaf Aprozper, Claroc's co-founder and CTO, says he submitted the issue through Meta's bug bounty program on October 8 and also tried to reach company staff on LinkedIn, but did not receive a response before publication. Meta says the bug bounty program is intended to help researchers raise such scenarios and improve the product.

For the AI sector, the incident highlights how design choices around link structure and discoverability can create privacy risks even when systems appear to use standard sharing protections. With the feature now suspended, Muse users no longer face this specific exposure route for the time being, but the case adds to scrutiny around privacy controls in consumer AI tools.

Our earlier article on Cohere’s planned acquisition of AI cybersecurity startup AISLE explained how the deal would add AI-driven software vulnerability detection to Cohere’s broader enterprise AI push alongside Aleph Alpha. We also noted that AISLE’s tools had already identified hundreds of new bugs, including vulnerabilities in widely used components such as OpenSSL, underscoring how quickly AI is becoming central to both defense and risk management.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.