Meta pauses Muse sharing after Claroc finds nearly 7,000 exposed links
🎧 Listen to this story
Meta paused the Muse AI agent’s conversation-sharing feature after security company Claroc identified nearly 7,000 links exposed on the internet. Claroc said the pages could show anything from a chat’s subject to full conversations and files, including contracts with names and amounts, spreadsheets and internal company calendars. The links were public on the cf.metaaiusercontent.com domain and could be found through titles related to the conversation’s topic.
Claroc notified Meta about the issue on October 8 and said it found new URLs on October 18. Meta confirmed that it had paused new sharing only on Tuesday (20/10), after Ars Technica asked about the issue, and said it would make security adjustments; it also called the discovery relevant to its Bug Bounty Program. Muse was available only in the United States and Canada.
Why it matters · editorial interpretation
The case could lead users and companies to reconsider sharing conversations with AI agents when links may expose files and internal information. The delay between notification and the pause also underscores the importance of rapid responses to vulnerabilities in sharing features.
Sources
Security