From Engadget · Anna Washenko · · 1m 10s
Meta pauses Muse sharing after privacy breach exposed thousands of chats
Researchers found that Meta's AI chat sharing feature left 6,800 conversations accessible to anyone through a simple DNS search.
In brief
Researchers found that Meta's AI chat sharing feature left 6,800 conversations accessible to anyone through a simple DNS search. Meta disabled its Muse chat sharing feature after security researchers discovered that shared conversations were exposed via passive DNS searches, revealing sensitive business and personal…
Meta's Muse sharing feature exposed private chats
Meta debuted its Muse agentic AI platform last month. Researchers at security firm Claroc discovered that shared conversation links could be accessed via passive DNS search because all URLs used the same domain name.
Researchers accessed 6,800 shared conversations
Claroc enumerated six thousand eight hundred links for shared Muse chats and viewed private information from business and personal applications. Exposed details included meeting times, loan applications, bank fraud alerts and internal company documents.
“Muse names each share's web address after the conversation's own title, and that address is written into public DNS.”
Meta pauses the feature and reviews the vulnerability
Meta said it has paused the sharing functionality while reviewing the report and considering changes to how these links can be discovered. Claroc researchers were unable to open previously accessed links following Meta's update.
“we've paused this functionality while we review this report and consider changes to how these links can be discovered.”
At a glance
Meta disabled its Muse chat sharing feature after security researchers discovered that shared conversations were exposed via passive DNS searches, revealing sensitive business and personal information.
