Researchers found 6,800 shared Meta Muse conversation links through public DNS records

Security firm Claroc said in a blog post that its researchers located more than 6,800 links to conversations shared through Meta $META's Muse AI agent, using one search of public DNS records.

Claroc opened a few hundred of the pages without an account or login. Most were harmless, such as small-business sites, listings and event calendars. A minority held dozens of personal records and internal business documents, the firm said.

Among them were one candidate's notes prepping for a confidential call with a frontier AI lab about an executive search, which named the lab's internal contact and the time of the meeting. Others were an internal revenue review addressed to the CEO of a national marketing company, a loan application from a small-business owner, and a to-do list containing a bank fraud alert that displayed part of an account number. The firm also found a report on a real-estate investor's performance that gave the addresses of two properties along with precise financial figures, and a workplace calendar that named dozens of employees next to the weeks they would be on vacation.

Muse shares conversations by link only, and a page opens for anyone who has the link, Claroc said. A user must ask Muse to create the share. The agent builds each page's web address from the conversation's title plus a random ID, under the domain cf.metaaiusercontent.com.

When someone opens a share, their browser looks up the hostname, and a passive-DNS provider can record and index it, Claroc said. That exposes the random ID along with the title. Claroc said the URL-scanning service urlscan.io also holds more than 75 saved scans of Muse share pages.

Claroc ran its search about a month after Muse launched on Sept. 8. After filtering out scan noise, it counted more than 6,800 share hostnames.

Claroc said its work covers one discovery channel and one hostname pattern on one product, so it does not measure Muse's total exposure. The firm said it cannot tell how long any share had been reachable or whether someone else found it first. It reported the issue to Meta’s bug bounty program on Oct. 8 and said it has no evidence anyone misused the shares. Claroc said it is withholding all hostnames, titles and links.

Meta CEO Mark Zuckerberg described Muse as "built from the ground up for privacy and security," according to Ars Technica.

Muse is projected to have reached 5 million downloads 22 days after its U.S. launch, faster than ChatGPT, Grok and Claude, according to Sensor Tower. The personal AI agent can send emails, book travel, fill out forms and make purchases on a user's behalf, Meta said. Internal testing had found at least one case in which the agent bypassed safety guardrails and surfaced a user's iCloud photos.