From Ars Technica · · 2m
Meta Muse leaks secrets through shared links
Researchers found Meta's new AI agent exposes sensitive business and personal data when users share conversations, prompting the company to suspend the feature.
In brief
Researchers found Meta's new AI agent exposes sensitive business and personal data when users share conversations, prompting the company to suspend the feature. Security researchers discovered Meta's Muse AI agent easily exposes private conversations through a design flaw in its sharing links, leading Meta to suspend…
Muse shares expose private data
Meta's Muse AI agent can expose sensitive information when users share conversations through web links, security researchers from Claroc reported Monday. Meta suspended the sharing feature after learning of the flaw.
What researchers discovered
Claroc researchers enumerated six thousand eight hundred links Muse users created for sharing conversations. Opening a few hundred revealed information clearly not intended to be public.
Secrets found in shared links
The exposed data included a candidate's confidential executive-search notes, a national marketing company's internal revenue review, a small-business owner's loan application, and a workplace's full-year staff vacation calendar.
How easy was the discovery
Researchers said gathering these links would have taken real effort, but it took one query. They used passive DNS searches through commercial services to find all Muse share links.
“If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query.”
The design flaw explained
All Muse share links use the domain cf.metaaiusercontent.com and include the conversation title in the URL alongside a long text string. This makes links discoverable through public DNS records anyone can search.
Claroc's term for the problem
Researchers called these GhostShares: pages that open for people who were never handed the link and that those people can find on their own.
“What makes Muse's shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search.”
Muse's earlier security problem
Three weeks after launch, macOS security expert Patrick Wardle discovered a zero-day vulnerability allowing any other app on the same device to gain complete control of a user's Muse account. Meta downplayed the severity.
What happens next
With Meta's suspension of the sharing feature, Muse users no longer face this particular threat for now. The company is reviewing the report and considering changes to how these links can be discovered.
The essence
Security researchers discovered Meta's Muse AI agent easily exposes private conversations through a design flaw in its sharing links, leading Meta to suspend the feature.
