Meta Suspends Muse AI Sharing Feature Over Privacy Concerns

Meta has temporarily suspended its Muse AI conversation-sharing feature after security researchers discovered that public DNS records exposed thousands of shared chat links. Claroc security researchers found the issue on the weekend and reported it to Ars Technica, after which Meta confirmed to Benzinga that they had paused the feature for further review.

The Muse system created shared conversation URLs with predictable structures, making them accessible through public domain name system records. As a result, passive DNS searches could uncover these shared conversations, and researchers uncovered around 6,800 of them. Some of the accessed chats contained sensitive information, including meeting details for a major AI lab, a small-business loan application, a bank fraud alert with partial account information, a company vacation calendar, and internal business documents.

Meta created the Muse bug bounty program to encourage security researchers to identify issues and improve the product. The company has now paused the sharing functionality while they review Claroc's findings and consider changes to the link discovery process. Claroc stated they could no longer access a sample of the previously available links.

This incident follows another Muse privacy controversy in September where Inc. technology columnist Jason Aten claimed Muse accessed his private messages without his permission. Meta denied the claim at the time, stating that Muse could only access Apple's Messages app when users opted in. Muse holds significant importance for Meta as they bet on it as a major AI product, with analysts expecting it to generate around $29 billion in revenue by 2030.