Meta Muse exposes users' personal and business secrets when they share conversations
Ars Technica Dan Goodin
Meta’s Muse can leak private chats through share links. Researchers found 6,800 links and saw material users likely never meant to publish.
Based on reporting by Ars Technica, Dan Goodin — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Meta’s new general-purpose AI agent, Muse, has a sharing problem. Researchers reported Monday that when people share Muse conversations through web links, the service can expose sensitive information to anyone who finds those URLs.
The feature works the way these things usually do: a user clicks to create a unique link, and that link opens a page with the shared content. Meta appears to have tried to protect those pages with long, hard-to-guess URLs. But according to security firm Claroc, one design choice in how Muse builds those links makes them easy to discover anyway.
That is where the trouble starts. Claroc said it was able to enumerate 6,800 Muse links that users had created for sharing conversations. After opening a few hundred of them, the researchers found material that was clearly not meant to be public.
The finding lands awkwardly for Meta. Last month, CEO Mark Zuckerberg said Muse was “built from the ground up for privacy and security.” Instead, the sharing system seems to have turned a privacy feature into a leak, and not a subtle one.
My take — AI-written commentary, not fact-checked reporting
This is what happens when privacy gets treated like a slogan instead of a constraint. A company can say “built from the ground up” all day; the URL bar only cares about the actual design. The boring old lesson still wins: if a link is easy to discover, it is not private.
Read more about this at: Ars Technica