What changed
Meta’s Muse AI assistant exposed shared conversations that were meant for specific recipients, according to security researchers at Claroc. They enumerated 6,800 sharing links and opened several hundred, finding executive-search notes, company revenue reviews, loan applications, bank-fraud details, property reports and an employee vacation calendar.
The problem was the share-link design. Muse placed conversation titles inside URLs under `cf.metaaiusercontent.com`, making the pages discoverable through passive DNS searches rather than only through a recipient’s private link.
Why it matters
This turns a familiar “share” button into a potential information leak. A user might think they are sending a conversation to one colleague, while the title and address can make it findable by people who were never given the link.
The exposed material was not harmless chatbot chatter. It included a frontier AI lab’s internal contact and meeting time, a loan amount, a partial bank account number and transaction details, exact property figures, and the weeks dozens of employees planned to be away. For companies using AI assistants around recruiting, finance or operations, the URL itself became part of the security boundary.
The practical lesson is blunt: a secret-looking link is not necessarily private if its structure advertises what it points to. The report does not establish how many users or organizations were affected, or whether Meta has changed the design or invalidated existing links. Until that is clear, sensitive conversations should not be shared through Muse’s public-link feature.
Comments
No comments yet.