Meta Suspends Muse Sharing Feature Due To Design Flaw

Researchers have found a design flaw in Meta's Muse that allows shared conversation links to be easily discovered, potentially exposing sensitive user information. According to WIRED AI, this flaw has led to the suspension of the sharing feature. Muse, a general-purpose AI agent, had allowed users to share conversations and other content with others via unique URLs.

The issue arises from the way these URLs are constructed, making them simple to find. Typically, such links contain a long sequence of text that is difficult to guess, but Muse's approach has made them more accessible. As a result, researchers from security firm Claroc were able to find and access numerous links, revealing confidential information.

The discovered information included sensitive business data, personal financial details, and other private information. This has raised concerns about the security and privacy of Muse, which was marketed as a platform built with privacy and security in mind. Meta CEO Mark Zuckerberg had emphasized Muse's focus on privacy and security when it was launched.

The researchers were able to find the links by utilizing a common technique that involves searching historical domain name records. This method allowed them to discover over 6,800 links, which they were then able to access and view the shared content. The ease with which they were able to do this has highlighted the need for Meta to re-examine its sharing feature.

Meta has responded to the discovery by suspending the sharing feature while it reviews the issue and considers making changes. The company had opened a bug bounty program to encourage researchers to identify and report potential security vulnerabilities. Through this program, the researchers were able to report their findings and bring the issue to Meta's attention.

The discovery of this flaw has also raised questions about the level of access that Muse requires to function. As a highly autonomous AI assistant, Muse needs access to a wide range of user accounts and information. This has led some to question whether Muse is worthy of the trust it requires, particularly in light of previous security concerns.

The issue is not the first security concern to affect Muse. Previously, a zero-day vulnerability was discovered that could have allowed other apps to gain control of a user's Muse account. While Meta downplayed the severity of this vulnerability, it has contributed to ongoing concerns about the security and privacy of the platform.