Meta Muse Exposes Users' Personal and Business Secrets in Shared Conversations

Meta Muse, the latest general-purpose AI agent developed by Meta, was designed with privacy and security as core principles. However, a fundamental design choice in how it constructs shareable URLs has created an unintended exposure vector. When users click a link to share a conversation, the resulting URL includes both the conversation title and a long, non-guessable string of characters. While this approach prevents casual guessing of individual links, it also makes the entire set of shared URLs highly discoverable through passive DNS monitoring.

Claroc researchers identified 6,800 unique Muse share links by performing passive DNS searches on the domain cf.metaaiusercontent.com. After opening a subset of these links, they extracted sensitive content ranging from confidential executive-search preparations—including names of internal contacts and meeting times—for national marketing firms—to personal finance details like small-business loan applications and bank fraud alerts. The findings included a detailed to-do list with partial account numbers and transaction timestamps, as well as internal performance reports from real-estate investors containing property addresses and exact return metrics.

The critical flaw lies in the decision to embed the conversation title directly within the URL path alongside a random token. This naming convention transforms what should be opaque, long strings into readable identifiers that can be indexed and discovered without requiring any interaction beyond a simple search query. As the researchers noted, "If you had asked us beforehand, we would have guessed that gathering these would take real effort" — yet a single query suffices to expose thousands of private sessions.

This incident underscores broader industry challenges around AI agent deployment and the importance of secure communication patterns. For organizations relying on cloud-based GPU infrastructure for AI workloads, understanding how application-layer design choices propagate privacy risks is essential. The case highlights why hardware providers like aigpu must work closely with software vendors to ensure end-to-end security across the stack, particularly when deploying AI agents that handle sensitive user data.