Meta has suspended the data-sharing feature of its Muse AI agent that allowed users to share content via web links. The company took this action after security researchers identified a critical vulnerability that exposed private user documents and correspondence to unauthorized access.
Experts from Claroc discovered approximately 6,800 accessible pages linked to Muse. These pages contained sensitive information, including internal financial reports, bank loan applications, details on mortgage payments, and employee vacation schedules. The researchers were able to locate these thousands of links using a single query.
The vulnerability stemmed from the way Muse generated URLs. Because the links were hosted on the cf.metaaiusercontent.com domain and included chat titles in the subdomains, they were indexed in public passive DNS databases. This allowed third parties to find the links without the users ever sharing them.
Meta confirmed the suspension of the feature following the report from Claroc. The company has not provided a timeline for restoring the service. This incident follows a previous security issue involving Muse, where a zero-day vulnerability identified by researcher Patrick Wardle could have allowed unauthorized account access.
