Meta’s Muse AI agent has undoubtedly been the social media company’s biggest product win in years.
Released on Sept. 8, downloads for the AI assistant surpassed 5 million in just 22 days. By Oct. 20, it had more than doubled that amount to over 10.9 million downloads, according data from market intelligence firm Sensor Tower viewed by Tech Crunch.
It reached those milestones much faster than more AI-centric rivals like OpenAI’s ChatGPT, X’s Grok and Anthropic’s Claude. ChatGPT hit the 5 million mark after 56 days, Grok hit it after 103 days, and Claude reached that many downloads after 492 days. Muse is only one of 23 apps to have ever hit 5 million downloads within 22 days of launch, according to Forbes.
Muse helps users do everything from book appointments, to fill out forms, and handle customer services. In essence, it “proactively takes tasks off your plate.”
With Meta already mining so much data from its users, one of Muse’s selling points was robust privacy protections. However, a new study from Claroc shows a big hole in Muse’s data security.
Muse privacy protections as a selling point
Meta Platforms undoubtedly knows its reputation among the general public. The terms Facebook and privacy are basically antithetical at this point. So it made sense for CEO Mark Zuckerberg to make sure potential users knew that they could trust Muse with their most personal queries.
“Muse is built from the ground up for privacy and security,” Zuckerberg announced on Sept. 8. “Your data and credentials live on the Muse Secure VM — an isolated linux computer with a browser, CPU, memory, and storage.”
“A Sentinel agent separate from your Muse runs on your VM,” he continued. “Every action or piece of data that goes out to the network has to be approved by the Sentinel. The kernel enforces that and it knows when it needs to get your permission to proceed.”
Read more: Mark Zuckerberg sends bold message to Meta investors after Muse
However, despite all of the clear thought and work that went into making Muse secure, it didn’t take long for people in the know to locate the holes in Meta’s security fence.
Two weeks after it’s release, Dan Goodin at Ars Technica outlined a “zero-day” vulnerability that showed that Muse’s security wasn’t as tight as Zuckerberg suggested. But now, researchers at Claroc also just exposed a vulnerability built into Muse’s design.
Sharing Muse conversations exposes you
The process that allows you to share the conversations you have with Muse lead to a vulnerability that the tech’s designers unwittingly embedded into the product.
When a user asks Muse AI to share a conversation, the AI agent publishes it as a web page that anyone with the link can open.
“That is by design: a public link is the only way the teammate it is sent to can open it,” Claroc said in its report.
But its research team found that those links are also easy to find by anyone with the time to look for them because “passive-DNS and subdomain-discovery tools list the hostnames directly.”
All it took for researchers to find the cache of data was opening a sample from a web browser in incognito mode and, even with no login, they were able to reveal users’ personal files and companies’ internal documents.
That data included a home-sale budget, a to-do note flagging a bank-fraud alert with a partial account number, a small-business loan application, a CEO-only revenue review, and a candidate’s confidential prep for an executive-search call with a frontier AI lab.
More Meta:
- Meta Muse gives AMD and Intel investors a reason to cheer
- Meta and Microsoft just sent employees a memo about Anthropic
- Bank of America sends a stark message to Meta stock investors
Every page was public “…because someone asked Muse to share it, and Muse did what it was asked,” Claroc said in its report. “What makes Muse’s shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search.”
Researchers had access to a cache of nearly 7,000 hostnames, but they only opened a few hundred of them and left the rest because lucky enough for them, and anyone else with more nefarious plans, the page titles had descriptive titles of the information contained inside. Making the process even less secure, they were able to open them without an account or a sign-in screen.
“Plenty of AI assistants share by public link. What makes Muse’s shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search,” Claroc said in its report. “Muse builds each share’s web address from the share’s title, a short phrase describing the conversation, then a random ID. The hostname usually gave away what a page held before we opened it.”
“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” Claroc said. “It took one query.”
How did Meta respond?
A Meta spokesperson told TheStreet that the company has paused the conversation sharing link functionality while it reviews Cleric’s report and that it will “consider changes to how these links can be discovered.”
The company said that when users share artifacts, which is the term Meta uses for the “interactive outputs” to your queries that the AI responds with, Muse does automatically create a page that can be accessed, like the Claroc report says. However, Meta also said that the page “can be accessed by those with the link.”
Claroc discovered 6,800 links without being sent them. They checked hundreds in incognito mode without a login, according to their report.
But the company is responding to the report.
“However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered,” said the spokesperson.
“We are glad to see it closed this quickly,” Claroc said in an update on Tuesday, Oct. 20.
So Claroc went back and rechecked 40 shares that it had previously opened without an account. None opened for them and the hostnames that serve their content returned an error message.
However, the security loophole may not be fully closed as the hostnames themselves, which include those pesky titles that make sorting the mundane data from the valuable so easy, were still in passive-DNS history, according to Claroc.
Related: Meta Muse gives AMD and Intel investors a reason to cheer
