Meta Muse exposes users' personal and business secrets when they share conversations

A single query is all that’s required to find thousands of conversations listed by title. Meta Muse exposes users’ personal and business secrets when they share conversations. Text settings Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only Learn more Minimize to nav Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through Web links, researchers reported Monday.

Like many online services, Muse lets users share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create an unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.

A single query is all that’s required Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others.

After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including: a candidate’s notes preparing for a confidential executive-search call with a frontier AI lab, naming the lab’s internal contact and the meeting time a national marketing company’s internal revenue review, marked for its CEO a small-business owner’s loan application, with the amount requested a to-do list that included a bank fraud alert, with a partial account number and a transaction amount and time a real-estate investor’s internal performance report, with two property addresses and exact return, income, and mortgage figures a workplace’s full-year staff vacation calendar, listing dozens of employees against the week each one would be away “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote.