Meta announced a suspension of the sharing functionality in Muse, its general-purpose AI agent, following a security disclosure by researchers at firm Claroc. The suspension comes after vulnerabilities were identified in how the platform constructs and distributes URLs for sharing conversations between users.
Researchers reported that Muse’s shared conversation links were discoverable through passive DNS searches, a technique that monitors historical domain name resolutions. The security firm was able to enumerate approximately 6,800 links created by Muse users and accessed hundreds of them to verify the vulnerability. Upon examination, the researchers found personal and business information that users did not intend to make publicly available. The researchers stated the discovery required minimal effort, taking only a single query to locate the links.
The vulnerability stems from a design decision in how Muse constructs its share URLs. The platform places conversation titles directly within the domain name rather than in the URL path, making them visible in public DNS records. Examples include links formatted as “home-sale-budget-9f21c8a3.cf.metaaiusercontent.com” and “loan-application-draft-a4c9e2.cf.metaaiusercontent.com.” The researchers termed these discoverable but unintended exposures “GhostShares,” noting that pages could be accessed by individuals who were never provided the link.
Asaf Aprozper, co-founder and CTO of Claroc, reported the findings through Meta’s bug bounty program on October 8. In response, Meta stated that it has paused the sharing functionality while reviewing the report and considering changes to how the links can be discovered. The company emphasized its commitment to reviewing security scenarios through its bug bounty program.
This disclosure represents the second security concern identified in Muse since its recent launch. The incident adds to questions about whether the platform warrants the extensive access to user accounts it requires to function.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI