A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.
Muse, Meta's privacy-focused AI assistant, includes a feature allowing users to share conversations, searches, and other content via a unique URL. This URL typically contains a lengthy sequence of text, making it difficult for unauthorized users to access the content. However, a design flaw in the way Muse URLs are created has exposed users' sensitive information.
Researchers from security firm Claroc discovered 6,800 such links, revealing confidential details such as loan applications, financial reports, vacation schedules, and more. The issue stems from the decision to include the conversation title in the URL's subdomain rather than in the path. This design choice makes it easy for anyone to discover these share links through a passive DNS search, as all URLs use the domain cf.metaaiusercontent.com.
Meta acknowledged the issue and paused the share functionality while reviewing the matter. With the feature suspended, users are no longer at risk from this particular vulnerability.
Written by urgent.news from Wired's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
