Researchers say Meta's Muse share links expose users' sensitive conversation content
Security firm Claroc reported that Muse share links use the domain cf.metaaiusercontent.com and include the conversation title in the subdomain, allowing researchers to enumerate about 6,800 shared links via passive DNS and access dozens of conversations containing sensitive personal and business information. Claroc called the phenomenon "GhostShares," said the behavior appears to be by design, and reported contacting Meta without a reply; the disclosure follows other Muse security concerns including a recent macOS zero-day reported by researcher Patrick Wardle.