Meta announced it is pausing the conversation-sharing functionality for Muse, the company’s general-purpose AI assistant, following a security report that revealed a significant privacy vulnerability in how shared links are constructed and discovered.
Researchers from security firm Claroc identified a design flaw in Muse’s sharing mechanism that allows unauthorized individuals to locate and access conversations users intended to share only with specific people. The researchers reported finding 6,800 shared conversation links and accessing sensitive information from hundreds of them with minimal effort. The core issue stems from Meta’s decision to include conversation titles directly within web addresses, which creates records discoverable through passive Domain Name System searches—databases that track historical domain name resolutions accessible to the public through commercial services.
The vulnerability centers on the uniform domain name cf.metaaiusercontent.com used for all shared links. By combining this known domain with conversation titles that appear in the URL structure, researchers were able to enumerate and access pages that were never shared with them. Examples of the vulnerable link patterns include home-sale-budget-9f21c8a3.cf.metaaiusercontent.com and loan-application-draft-a4c9e2.cf.metaaiusercontent.com. Claroc researchers termed these discoverable pages “GhostShares,” describing them as accessible to people who were never provided the link and could locate them independently.
Meta acknowledged the report through a statement indicating the company opened a bug bounty program to allow researchers to identify such vulnerabilities. The researcher who submitted the findings reported attempting to contact Meta through both the bug bounty program on October 8 and LinkedIn outreach, though receiving no response. The suspension of the sharing feature removes the immediate threat while Meta reviews the issue and considers design modifications to prevent future unauthorized discovery of shared content.
This incident adds to recent scrutiny of Muse’s security posture. Earlier this year, macOS security researcher Patrick Wardle disclosed a separate zero-day vulnerability that could allow other applications on a device to gain complete control of a user’s Muse account, though Meta minimized the severity assessment at that time.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI