Muse, Meta’s new general-purpose AI agent, can expose sensitive information when users share conversations over web links, researchers reported Monday. In response to Ars’ questions about the behavior, Meta said it will suspend the sharing feature while the company reviews it and considers making changes.
Like many online services, Muse has allowed users to share searches, conversations, images and similar content with others. These sharing features typically involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To prevent unwanted people from accessing potentially sensitive information, URLs often contain a long sequence of text that cannot be easily guessed.
A single consultation is all that is required
Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” appears to take the same precautions. But a core design decision for building URLs has made links easy to discover. As a result, researchers from security firm Claroc said they were able to list 6,800 links that Muse users created to share conversations with others. After opening a few hundred of them, researchers found information that was clearly not intended to be publicly available, including:
- Notes from a candidate preparing for a confidential executive search call with a cutting-edge AI lab, indicating the lab’s internal contact and meeting time.
- Internal revenue review of a national marketing company, marked for its CEO.
- loan application for small business owners, with the requested amount
- a to-do list that included a bank fraud alert, with a partial account number and transaction amount and time
- Internal performance report of a real estate investor, with two property addresses and exact profitability, income and mortgage figures.
- the year-round staff vacation calendar at a workplace, listing dozens of employees based on the week each would be absent
“If we had been asked beforehand, we would have guessed that putting them together would require real effort,” the researchers wrote. “A consultation was needed.”
In an emailed statement responding to questions from Ars, Meta said:
We opened up the Muse bug bounty program so researchers could come up with different scenarios and help us continue to improve the product. People have the ability to share specific Muse artifacts, creating a page that can be accessed by those with the link. However, we have paused this functionality while we review this report and consider changes to how these links can be discovered.
Asaf Aprozper, co-founder and CTO of Claroc, said he reported the findings through Meta’s bug bounty program on October 8 and also tried reaching out to people at Meta on LinkedIn, but got no response either way.
The easiest way to discover URLs is to perform a passive DNS lookup through one of the many commercial services available. Passive DNS records store the historical resolution of domain names to IP addresses, as well as name server and mail server records over time. Passive DNS systems typically collect DNS responses from sensors located on recursive DNS resolvers or other infrastructure. A passive DNS record is usually created when a monitoring system observes a DNS response. In this case, once the desired party clicks on the sharing link, the DNS information is recorded in a searchable database.
