Meta disables Muse sharing tool after private information becomes accessible
Claroc researchers found 6,800 shared-conversation links through DNS searches, with some exposing personal and company information.
Meta has disabled conversation sharing on its Muse AI platform following findings by security firm Claroc that shared links could expose sensitive information. Meta said it was reviewing the findings and considering changes to how people can discover those links.
Claroc identified 6,800 links and said it could view information including a company's vacation calendar, internal corporate documents and an application for a small-business loan. Other accessible material included a fraud notification from a bank containing partial account details and meeting times involving a frontier AI lab.
The sharing tool generated web addresses that placed conversation titles in subdomains under a common domain, according to Claroc. Researchers could locate those addresses through passive DNS searches, which use records connecting domain names with IP addresses.
Ars Technica initially reported the research and received Meta's response. After Meta made its update, Claroc said its researchers tested a sample of links they had opened before and could no longer access them.
