Meta Muse’s sharing feature has a privacy vulnerability: the generated conversation links are easily enumerable, leading to the leakage of personal and business secrets.
Security firm Clarot discovered that Meta’s newly launched AI agent, Muse, generates URLs with insufficient randomness when the conversation-sharing feature is enabled, allowing attackers to obtain 6,800 user-shared links through simple enumeration; among these, hundreds of links exposed non-public personal and business-sensitive information. Meta has suspended this sharing feature and initiated a review.