Meta's AI Agent 'Muse' Pauses Sharing Feature After Exposing Sensitive User Data
Meta's general-purpose AI agent, Muse, has been found to inadvertently expose sensitive user information when conversations are shared via web links. Researchers from the security firm Claroc reported that a significant amount of private data, ranging from business financial reviews to personal loan applications, was accessible through these shared links. In response to inquiries from Ars Technica, Meta confirmed it has paused the sharing feature and is conducting a review to address the discovered vulnerabilities.
Vulnerability Details: GhostShares and Passive DNS
The core issue lies in how Muse constructs its shareable URLs. While designed with a long, seemingly unguessable string of characters, a critical design decision made these links discoverable. Researchers found that by performing a passive DNS search, they could enumerate thousands of shared links. This was facilitated by the use of a consistent domain name, cf.metaaiusercontent.com, and crucially, the inclusion of the conversation's title directly within the URL's subdomain. This practice, which Claroc has termed "GhostShares," allows pages to be accessed by individuals who were never intended to receive the link, and who can find them through public DNS records.
Claroc researchers demonstrated the severity of the issue by accessing a variety of sensitive documents. Examples included a candidate's confidential notes for an executive-search call with an AI lab, a national marketing company's internal revenue review intended for its CEO, a small-business owner's loan application detailing the requested amount, a to-do list containing a bank fraud alert with partial account details, a real-estate investor's performance report with property addresses and financial figures, and a staff vacation calendar for a workplace. The researchers noted that gathering this information required "one query," significantly underestimating the ease of discovery.
Meta's Response and Broader Context
Asaf Aprozper, co-founder and CTO of Claroc, reported the findings through Meta's bug bounty program on October 8th but received no immediate reply. Meta, in a statement, acknowledged the report and stated, "We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product." The company further elaborated, "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered." This incident follows a previous security concern where macOS security expert Patrick Wardle discovered a zero-day vulnerability allowing other apps on the same device to gain control of a user's Muse account, which Meta had downplayed.
Muse has rapidly gained popularity, climbing to top spots in app stores due to its ability to autonomously perform tasks like filling forms, booking appointments, and making purchases. However, this functionality necessitates broad access to a user's accounts, raising significant trust implications. The discovery of the "GhostShares" vulnerability further intensifies scrutiny on whether Muse warrants the extensive access it requires, especially given Meta's past downplaying of security issues. The suspension of the sharing feature, at least temporarily, mitigates this specific risk for Muse users.
