Meta Pauses Muse AI Sharing After Data Leak
Meta disabled the sharing feature of its Muse AI assistant after security researchers found thousands of private conversations were publicly accessible on the web.
Meta Platforms Incorporated paused the sharing functionality of its Muse AI assistant after security researchers discovered that private conversations were publicly accessible on the web. The vulnerability allowed unauthorized access to sensitive data, including a small business owner's loan application, a marketing company's revenue review, and a workplace staff calendar.
Researchers at the security firm Claroc identified more than 6,800 Muse links by searching public DNS records. The firm found that the vulnerability stemmed from the way Meta designed its links, which combined a conversation's title with a random ID. This structure allowed hostnames to reveal the content of the pages, effectively turning public DNS records into a directory for private web traffic.
Muse spokesperson Tracy Clayton confirmed the company disabled the feature to review the report and evaluate changes to how these links are discovered. The functionality remains paused while the company considers security updates to prevent further exposure.
