Meta Suspends Muse Sharing After 6,800 Links Exposed Sensitive Data
Updated
Updated · WIRED · Oct 21
Meta Suspends Muse Sharing After 6,800 Links Exposed Sensitive Data
3 articles · Updated · WIRED · Oct 21
Summary
Meta halted Muse’s public-link sharing after Claroc researchers showed they could enumerate 6,800 shared conversation URLs and view sensitive business and personal records.
One design choice drove the exposure: Muse put conversation titles in subdomains on cf.metaaiusercontent.com, making links discoverable through passive DNS databases after recipients opened them.
Claroc said it reported the flaw through Meta’s bug bounty on Oct. 8 and also contacted staff on LinkedIn, but received no reply before publication.
Muse’s rapid rise in Apple’s App Store and its broad access to user accounts heighten the stakes, especially after a separate zero-day account-takeover flaw surfaced three weeks after launch.