A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse

Key points

• Researchers from security firm Claroc say Meta's Muse AI assistant exposed sensitive conversations shared through web links. They found 6,800 share links and opened a few hundred, revealing items including a loan application, a bank fraud alert and a staff vacation calendar.
• The links were easy to find because the conversation title appeared in the web address, which public DNS records captured. Meta said it has paused the sharing feature while it reviews the issue and considers changes.
• Earlier, a separate vulnerability reported by security expert Patrick Wardle had also been downplayed by Meta.