Meta Muse leaks secrets via discoverable share links

Security researchers at Claroc found that Meta's AI agent Muse exposes sensitive user data through easily discoverable share links. Because Muse embeds conversation titles directly into URLs under the domain cf.metaaiusercontent.com, a single passive DNS query revealed 6,800 shared links. Opening a sample exposed confidential documents including executive-search notes, internal revenue reviews, loan applications, and employee vacation calendars. The flaw stems from including the conversation title in the URL, making links findable without ever being handed them. Meta, which markets Muse as privacy-focused, did not immediately respond to questions.