Meta pauses Muse sharing after 6800 exposed pages found

Meta's personal AI assistant Muse has a privacy issue with its chat sharing feature. Security team Claroc reported that over 6,800 Muse share page links could be found through passive DNS lookups. Some pages held personal financial records, company files, and other sensitive info. Meta has paused the feature.

The issue is that Muse builds web addresses based on chat titles under the cf.metaaiusercontent.com domain. Once titles sit in subdomains, they may get logged by passive DNS services. Researchers checked hundreds of pages and found company revenue files, loan applications, and bank fraud alerts, all viewable without logging in.

Meta has now paused the feature, and pages that could once be opened without login no longer work. But domains already saved in passive DNS history remain. Claroc says there is no sign the pages were misused, and its study was limited, so the full scale of exposure is unknown.