{
  "id": 15887976,
  "title": "A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse",
  "url": "https://urgent.news/2026/10/21/a-design-flaw-in-share-links-exposes-users-personal-conversations",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T12:35:00.000Z",
  "source": {
    "name": "Wired",
    "slug": "wired",
    "url": "https://www.wired.com/story/a-design-flaw-in-share-links-exposes-users-personal-conversations-with-meta-muse/"
  },
  "original_language": "en",
  "account": "Muse, Meta's privacy-focused AI assistant, includes a feature allowing users to share conversations, searches, and other content via a unique URL. This URL typically contains a lengthy sequence of text, making it difficult for unauthorized users to access the content. However, a design flaw in the way Muse URLs are created has exposed users' sensitive information. Researchers from security firm Claroc discovered 6,800 such links, revealing confidential details such as loan applications, financial reports, vacation schedules, and more. The issue stems from the decision to include the conversation title in the URL's subdomain rather than in the path. This design choice makes it easy for anyone to discover these share links through a passive DNS search, as all URLs use the domain cf.metaaiusercontent.com. Meta acknowledged the issue and paused the share functionality while reviewing the matter. With the feature suspended, users are no longer at risk from this particular vulnerability.",
  "summary": "The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.",
  "key_points": [
    "Design flaw in Muse share links exposed sensitive user information",
    "Researchers found 6,800 share links revealing confidential details",
    "Meta paused share functionality while reviewing the vulnerability"
  ],
  "editors_take": "Prioritizing easy URL structure over security protocols turns private AI interactions into searchable data, exposing sensitive user information to anyone performing a passive DNS search.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}