Meta's Muse AI agent can expose sensitive information when users share conversations through web links, researchers reported Monday.
The AI, which Meta CEO Mark Zuckerberg said was 'built from the ground up for privacy and security,' allows users to share searches, conversations, images, and similar content with others via unique URLs.
These URLs typically contain long sequences of text that are difficult to guess, but Muse's design made them easy to discover.
Researchers from security firm Claroc found that Muse's share links can be enumerated due to a central design decision. They were able to discover 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information clearly not intended for public access, including internal meeting notes and financial details.
"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote.
"It took one query." In response, Meta said it was suspending the sharing feature while reviewing the report and considering changes to how these links can be discovered.
Asaf Aprozper, co-founder and CTO of Claroc, reported the findings through Meta’s bug bounty program on October 8, but received no reply.
The easiest way to discover the URLs is through passive DNS searches, which store historical DNS resolution data. Muse's share links use the domain name cf.metaaiusercontent.com, making them searchable.
The decision to include the conversation title in the subdomain rather than the URL path made public discovery possible. "Plenty of AI assistants share by public link," Claroc said.
"What makes Muse’s shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search.
We call these GhostShares: pages that open for people who were never handed the link, and that those people can find on their own."
Muse quickly became one of the top apps in Apple’s App Store, but three weeks after its launch, a zero-day vulnerability was discovered that allowed other apps to gain full control of a user’s Muse account.
Meta downplayed the vulnerability, stating that exploitation required a compromised device. The ease of discovering share links raises questions about whether Muse is worthy of the access it requires.
With Meta’s suspension of the feature, Muse users no longer face this particular threat, at least for now.
Source: arstechnica
