Meta Muse exposes users' personal and business secrets when they share conversations
ars ·
Security researchers from Claroc have revealed that Meta's AI agent, Muse, inadvertently exposes sensitive user data through its conversation sharing feature. By including the conversation title in the generated URL, the links become discoverable via passive DNS searches, allowing anyone to find and access them without a direct invitation. The investigation uncovered thousands of such 'GhostShares,' containing private details like loan applications, executive search notes, and financial reports. This vulnerability persists despite Meta CEO Mark Zuckerberg’s claims that the platform was built with privacy and security as core foundations. The issue is compounded by a recent zero-day exploit found by Patrick Wardle, which allowed other apps to hijack Muse accounts on compromised devices. Although Claroc determined this behavior appears to be by design, they noted that Meta did not respond to their inquiries about the flaw. Consequently, users are advised to limit personal information in chats and delete share links promptly to mitigate these risks.
ars