Meta Muse Exposes Sensitive User Data via Easily Discoverable Links

• •Meta's Muse AI exposed over 6,800 sensitive links due to flawed URL design.
• •Confidential information including business documents and personal data was accessible.
• •Meta has paused the sharing feature while reviewing the security report.

Meta's AI agent, Muse, has been found to expose sensitive user conversations through easily guessable URLs, as reported by researchers from Claroc. The URLs, which can be discovered through passive DNS queries, led to the exposure of over 6,800 links containing confidential information, including internal business documents and personal records. This incident has prompted Meta to pause the sharing feature of Muse while they investigate the issue. The design flaw stems from the inclusion of conversation titles in the URLs, making them predictable. Researchers discovered various sensitive data, such as a candidate's notes for a confidential call, internal revenue reviews, and loan applications. Meta's spokesperson acknowledged the issue and stated that they are reviewing the report for potential changes to the link discovery process. The situation highlights ongoing concerns about privacy and security in AI-assisted communication tools.