Meta announced it is temporarily suspending the sharing functionality of Muse, its general-purpose AI agent, following a security disclosure by researchers at firm Claroc. The suspension comes after the researchers demonstrated how sensitive user information could be accessed through shared conversation links that were designed to be private.
The issue stems from how Meta constructed the unique URLs used to share Muse conversations. While the links contain long character sequences meant to prevent easy discovery, Claroc researchers identified a critical design flaw: the conversation title is embedded directly in the web address as part of the subdomain. This placement allows the links to be indexed in publicly searchable passive DNS databases whenever someone clicks a shared link. Researchers demonstrated they could discover approximately 6,800 share links using a single search query through commercial DNS services.
Upon examining several hundred of these exposed links, the researchers found conversations containing information clearly not intended for public access, including personal financial details, business communications, and other confidential materials. Claroc’s co-founder noted the vulnerability was surprisingly easy to exploit, contrary to expectations that discovering such links would require significant technical effort. The researchers named this vulnerability type “GhostShares,” describing pages that open for people who were never given the link but can discover them independently through public records.
In response to inquiries, Meta acknowledged the report and stated it opened a bug bounty program specifically to help researchers identify such scenarios. The company confirmed it has paused the sharing functionality while reviewing the findings and considering modifications to how the links are discovered. The researcher who reported the findings indicated they submitted their disclosure through Meta’s bug bounty program and attempted direct contact, though they reported receiving no response.
This incident adds to recent security concerns surrounding Muse. Earlier this year, macOS security researcher Patrick Wardle identified a zero-day vulnerability that could allow other applications on a device to gain complete control of a user’s Muse account. Meta had previously downplayed that finding despite the potential for exploitation through relatively simple attack methods.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI