Meta has paused the sharing functionality of its Muse AI assistant while investigating a privacy vulnerability discovered by researchers at security firm Claroc. The feature allows users to generate unique links to share conversations, searches, and other content with others, but a design flaw made these links susceptible to discovery.
Claroc researchers identified that all Muse share links use the same domain name, cf.metaaiusercontent.com, and include the conversation title within the subdomain. This combination made it possible for researchers to enumerate thousands of links through passive DNS searches, which record historical domain name resolutions. Claroc termed these discoverable pages “GhostShares,” noting that they could be found by individuals who never received the link directly.
When researchers examined several hundred of the discovered links, they found sensitive information that users did not intend to be publicly available. According to Claroc, the discovery process was surprisingly straightforward, requiring minimal effort to access confidential material. Asaf Aprozper, co-founder and CTO of Claroc, reported the findings through Meta’s bug bounty program on October 8 and attempted to contact Meta representatives through LinkedIn without receiving a response.
In response to questions about the vulnerability, Meta acknowledged receiving the report and stated that it had suspended the sharing feature while reviewing the findings and considering modifications to how these links can be discovered. Meta noted that the Muse bug bounty program was established to help researchers identify scenarios for improvement. The suspension has removed the immediate threat to users from this particular privacy concern.
The vulnerability adds to previous security concerns with Muse, which Meta markets as a trusted AI platform requiring extensive access to user accounts and data. Earlier security research had identified other vulnerabilities in the system, raising questions about whether the assistant merits the level of access it requires from users.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI