Meta Muse flaw exposes 6,800 AI chats
What's the story
Meta has temporarily suspended a feature of its AI assistant, Muse, that allowed users to share conversations via links. The decision comes after researchers from cybersecurity firm Claroc discovered over 6,800 Muse links in public DNS records. The findings highlighted the potential for sensitive information to be accessed through these shared links.
Official statement
We've paused this functionality: Muse's spokesperson
In light of the report, Muse's spokesperson Tracy Clayton confirmed the suspension of the controversial feature.
"People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Clayton said in an email to The Verge.
"However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."
Security breach
Claroc's report highlights easy access to shared links
Claroc's report revealed that the way Meta designed these links made them easy to find.
"Muse builds each share's web address from the share's title, a short phrase describing the conversation, and a random ID," Claroc said.
By searching public DNS records, which act as a phone book for internet traffic, Claroc was able to view hundreds of Muse conversations.
These included sensitive information such as a marketing company's revenue review and notes for an AI lab job candidate's call.
Recurring issue
Similar incidents reported with other AI models
Notably, this isn't the first time an AI sharing feature has exposed conversations more than intended.
Similar incidents have been reported with OpenAI's ChatGPT, Anthropic's Claude, and xAI's Grok.
These cases highlight a recurring issue in the design of these technologies, where user conversations can unintentionally become public through shared links or other means.