A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
wired ·
Security researchers from Claroc discovered a significant design flaw in Meta’s AI assistant, Muse, which allowed them to easily enumerate and access sensitive user conversations. The vulnerability stemmed from the way share links were constructed, specifically by embedding conversation titles in the subdomain of URLs hosted on cf.metaaiusercontent.com. This structure made the links discoverable through passive DNS searches, exposing private data such as loan applications, financial reports, and personal schedules. In response to these findings, Meta has suspended the sharing feature while it reviews the issue and considers necessary changes. This incident follows other recent security concerns for Muse, including a zero-day vulnerability reported by Patrick Wardle that could allow account hijacking. Although Meta markets Muse as being built with privacy and security in mind, this flaw highlights risks associated with its deep integration into user accounts. The company stated that the bug bounty program facilitated the discovery of this issue, prompting the immediate pause on the functionality.
wired