Meta Muse shared conversations were discoverable through public DNS records
Researchers found that Meta’s Muse AI assistant exposes shared conversations to discovery through publicly searchable DNS records, potentially revealing personal and business information. The issue matters because users may treat shared links as private and Muse is designed to access many of their accounts.
Security firm Claroc said it identified 6,800 share links with a single query and found sensitive material in a review of a few hundred. The links use a common domain and include conversation titles in their web addresses, making them easier to locate through passive DNS databases. The report follows an earlier account-control vulnerability in Muse; Meta had not immediately responded to questions about the newly reported issue.
- Researchers found 6,800 discoverable Muse conversation links.
- Conversation titles in web addresses made links searchable.
- The findings raise questions about Muse’s privacy safeguards.
New here? Start with this
Meta Muse is an AI assistant that can draw on information from users’ connected accounts to answer questions. Users can share conversations by creating links, which may include the conversation title in the web address.
Public DNS records help computers find websites and can be searched by researchers and others. If a shared link appears in those records, it may be easier to discover than users expect, and the conversation could contain personal or business information.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Users could reasonably expect shared conversations to be difficult to discover, especially when an assistant can access sensitive accounts and the links reveal conversation titles. Meta should be expected to minimise exposure, explain the risks clearly and address any design choices that make private material easier to find.
The case against
A shared link is intended to let others access a conversation, so making it reachable may be part of the feature rather than a security flaw; users and organisations also retain responsibility for what they choose to share. Public DNS records may aid discovery without proving that conversations were broadly accessed, and the reported sample does not establish the scale of actual harm; the concern should be assessed against the feature’s design and user warnings.
Read the full article at the source →
Originally published by Ars Technica as “Meta Muse exposes users’ personal and business secrets when they share conversations”.