Meta Pauses Muse Chat Sharing After Researchers Find Exposed Private Conversations

Meta has switched off the conversation-sharing feature on its Muse AI platform after security researchers found that shared chat links could be discovered and opened by anyone.

Claroc, the security firm behind the discovery, said every share link followed the same pattern: the same domain name, with the conversation's title used as the subdomain. Because those addresses are recorded in public DNS - the system that maps readable web addresses to the IP addresses browsers use - a single passive DNS search returned thousands of links, listed by name. Claroc described the result as looking like a table of contents.

The researchers catalogued 6,800 shared Muse conversations and viewed private material from both business and personal uses of the service. Among the exposed details were meeting times with a frontier AI lab, a small-business loan application, a bank fraud alert containing partial account information, a company vacation calendar and other internal documents.

Meta told Ars Technica, which first reported the findings, that it had paused the feature while it reviews the report and considers changes to how these links can be discovered. Claroc said that after Meta's update, its researchers could no longer open a sampling of the links they had previously accessed.

Source: Engadget