@dps: An update on @Muse shared artifacts. Earlier this week, a security researcher published details of a design flaw in @Mu…
Summary
Muse disclosed a design flaw where shared artifact URLs were discoverable via passive DNS, prompting a temporary shutdown of sharing while the issue was fixed; old links now redirect to a notice requesting new URLs, and the Muse bug bounty program offers up to $300,000 for valid reports.
View Cached Full Text
Cached at: 10/22/26, 07:42 PM
An update on @Muse shared artifacts.
Earlier this week, a security researcher published details of a design flaw in @Muse shared artifacts: some shared artifact URLs were discoverable via passive DNS. We disabled sharing immediately to prevent any unintended exposure, which is why shared artifacts were temporarily unavailable. Some articles we have seen in the press mentioned a flaw in chat sharing, and that is not the case - this issue was specifically about shared artifacts.
The underlying issue is now fixed, and sharing is back on.
If you shared an artifact before the fix: it now has a new URL. Anyone visiting the old link will see a note asking them to get the new one from you. We know that’s a pain, and we’re sorry for the disruption — but protecting user data has to come first.
We’re grateful to the researchers who find and report issues like this. The Muse bug bounty program exists so these reports can reach us directly and responsibly, with awards of up to $300,000 for valid findings. Every report is reviewed. If you find something, please send it our way.
Similar Articles
Meta turns Muse sharing back on
Meta re-enabled sharing in its Muse AI product after Claroc security researchers discovered that public conversation links were easily discoverable via public DNS, exposing sensitive user documents; Meta issued new URLs for previously shared artifacts and says the underlying issue is fixed.
@dps: We appreciate this report and have issued a hotfix to the Muse Mac app. This was a local privilege escalation attack, n…
The Muse Mac app had a local privilege escalation vulnerability that was responsibly disclosed and fixed with a hotfix. The company has issued a fix and provided details on the issue, emphasizing transparency and security.
Meta Muse exposes users' personal and business secrets when they share conversations
Security researchers from Claroc found that Meta's new AI agent Muse exposes users' sensitive shared conversations via easily enumerable URLs discoverable through passive DNS queries, prompting Meta to suspend the sharing feature while it reviews the issue.
Muse will apparently let you download its entire filesystem
Developers found that Meta's Muse AI platform can be prompted to share its entire filesystem, revealing internal workings and highlighting security vulnerabilities. Meta responded that the incident doesn't pose a significant risk to infrastructure or user data.
@dps: I’ve seen a couple of posts about this so wanted to demystify. Today, every Muse user gets a free computer in the cloud…
Muse users now have access to a free secure virtual computer in the cloud, offering full transparency and control similar to a personal Linux system while ensuring safety from threats.