Meta Muse exposes users' personal and business secrets when they share conversations
Summary
Meta's new AI assistant, Muse, allows users to share conversations through special web links. Security researchers found that these links can be easily found online, exposing sensitive personal and business information that users did not intend to share publicly.Key Facts
- Muse is a general-purpose AI assistant created by Meta, which users can share conversations with via clickable web links.
- These links usually have long, hard-to-guess text to protect privacy, but Muse’s design includes the conversation title in the web address.
- Researchers from security company Claroc found 6,800 Muse links by searching public DNS records, then accessed hundreds revealing private information.
- Exposed data included job search notes, company revenue reports, loan applications, bank fraud alerts, real estate performance details, and staff vacation calendars.
- The URLs use the domain cf.metaaiusercontent.com, making it easier to locate them through public internet records.
- The researchers called these easily discoverable shared pages “GhostShares” because people who were not given the links could still find them.
- Muse quickly became popular on Apple’s App Store and requires access to many user accounts to perform tasks like booking appointments and making purchases.
- Meta CEO Mark Zuckerberg described Muse as built with privacy and security in mind, but this design choice contradicts that claim.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
