Meta has switched Muse sharing back on. It paused the feature on Tuesday. That came after Ars Technica asked about research showing that anyone could find pages shared from its AI agent.
David Singleton, who works on Muse at Meta, announced the fix on Thursday in a post on X. He said Meta disabled sharing immediately after a researcher published details of the flaw. The flaw affected only shared Muse artifacts, he wrote. Some press reports had described a flaw in chat sharing, which he said was not the case.
An update on @Muse shared artifacts.
Earlier this week, a security researcher published details of a design flaw in @Muse shared artifacts: some shared artifact URLs were discoverable via passive DNS. We disabled sharing immediately to prevent any unintended exposure, which is why shared artifacts were temporarily unavailable. Some articles we have seen in the press mentioned a flaw in chat sharing, and that is not the case – this issue was specifically about shared artifacts.
The underlying issue is now fixed, and sharing is back on.
If you shared an artifact before the fix: it now has a new URL. Anyone visiting the old link will see a note asking them to get the new one from you. We know that’s a pain, and we’re sorry for the disruption — but protecting user data has to come first.
We’re grateful to the researchers who find and report issues like this. The Muse bug bounty program exists so these reports can reach us directly and responsibly, with awards of up to $300,000 for valid findings. Every report is reviewed. If you find something, please send it our way.
Artifacts shared before the fix now have new web addresses. Anyone who opens an old link sees a note asking them to get the new one. Singleton thanked the researchers and said Muse’s bug bounty programme pays up to $300,000 for valid findings.
One search, 6,800 pages
Claroc published the research on 18 October. It is a security firm that sells tools to track how companies use SaaS and AI apps. It found more than 6,800 Muse share pages with a single search of a commercial passive DNS service. Such services keep a history of the web addresses people have looked up.
Every Muse share sat on the same Meta domain. Each address began with the title of the shared conversation, followed by a random ID. When someone opened a link, passive DNS services logged the whole address, random ID and all. The researchers then opened a few hundred pages without logging in.
“If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query,” the Claroc researchers wrote.
Most of the pages were harmless, Claroc said. A minority were not. They included a small-business loan application and a workplace calendar showing when dozens of staff would be on holiday. Others held a marketing company’s revenue review for its chief executive. A property investor’s report listed two addresses and mortgage figures.
One to-do list showed a bank fraud alert with a partial account number. Another held a job candidate’s notes for a confidential call with a frontier AI lab. They named the lab contact and gave the meeting time.
Meta’s response
Asaf Aprozper, Claroc’s co-founder and chief technology officer, told Ars Technica he reported the problem on 8 October. He used Meta’s bug bounty programme. He also tried to reach Meta staff on LinkedIn and got no reply, he said.
“People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered,” Meta said in a statement to Ars Technica.
Meta launched Muse in September as an agent that books, buys and fills in forms using a person’s accounts. On Wednesday’s third-quarter earnings call, Mark Zuckerberg said more than 10 million people had set it up, TechCrunch reported. He said people connecting it to their email and calendars showed they trusted its security setup.
The agent has drawn privacy complaints before. In September, a user said Muse gave his address to a Marketplace buyer. Meta also denied that Muse read a journalist’s private messages. Zuckerberg called Muse ready despite the risks, The New York Times reported this month.
Claroc said it had no evidence that anyone misused the pages. None of the 40 shares it rechecked on 20 October would open. But the addresses, with their titles, are still in passive DNS history, the firm said.