Share Links in Meta's Muse AI Agent Expose Users' Private Conversations
Researchers at security firm Claroc found that share links created by Meta's Muse AI agent make users' private conversations easy to discover. Meta has paused the sharing feature.
Muse, Meta's new general-purpose AI agent, can expose sensitive information when users share conversations through web links, researchers at security firm Claroc reported on Monday. After questions from Ars Technica, Meta said it is suspending the sharing feature while it reviews the problem and considers changes.
How the links were found
Muse lets users generate a unique link to a conversation or other content that anyone holding the link can open. Such addresses normally include a long, hard-to-guess string of characters. Muse does something similar, but places the conversation title in the subdomain rather than in the URL path. All the links use the domain cf.metaaiusercontent.com, so they can be found through passive DNS searches. A passive DNS database stores historical records of how domain names resolve to IP addresses, and once a share link is opened, the record lands in a searchable database.
Using this method, Claroc researchers enumerated 6,800 links. After opening a few hundred, they found information plainly not meant to be public: a candidate's notes for a confidential call with an AI lab, a company's internal revenue review, a small-business owner's loan application, a to-do list containing a bank fraud alert, a real-estate investor's performance report, and a workplace vacation calendar listing dozens of employees.
Asaf Aprozper, Claroc's cofounder and CTO, said he reported the findings through Meta's bug bounty program on October 8 and also tried to reach Meta staff on LinkedIn, but received no reply.
Background
Muse autonomously fills out forms, books appointments, makes purchases and creates documents, so it needs access to most of a user's accounts. Meta CEO Mark Zuckerberg had said the agent was built with privacy and security in mind. Three weeks after launch, security expert Patrick Wardle found a vulnerability that let another app on the same device take control of a Muse account. Meta played down its severity, noting that an attack required the device to already be compromised.
