Article · AI translation
IT Home reported on October 24 that the conversation-sharing feature of Muse, Meta’s personal AI assistant, has been found to pose a privacy risk.
In a report published on October 18, cybersecurity research team Claroc said researchers found through passive DNS queries that the domains of more than 6,800 Muse shared pages could be retrieved. Some pages contained personal financial information, internal company documents, and confidential meeting preparation materials. Meta subsequently suspended the feature and said it was investigating the issue and evaluating improvements.
Claroc’s research team found that Muse generates web addresses from the titles of conversations shared by users and hosts them under the cf.metaaiusercontent.com domain. Because conversation titles are written into subdomains, visits to shared pages by users or recipients may cause the associated domains to be recorded by passive DNS services and subsequently appear in searchable historical DNS databases.
The researchers said a single passive DNS query revealed the hostnames of more than 6,800 shared pages. Claroc then sampled hundreds of pages and found that some contained sensitive information involving corporate revenue review documents, small-business loan applications, bank fraud alerts, real estate investment data, and employees’ annual leave schedules. The researchers also found materials a candidate had prepared for a confidential phone call with the head of a leading AI lab, including internal contact information and the meeting time.
Claroc noted that the pages could be accessed without logging in to a Meta account; anyone with the corresponding link could view their contents. The issue did not arise because attackers cracked randomly generated identifiers, but because complete domain names were recorded in passive DNS databases, allowing researchers to rediscover the shared addresses through queries.
Claroc submitted the issue through Meta’s bug bounty program on October 8. In response, a Meta spokesperson said users could share specific Muse content and generate pages accessible via links; the company had suspended the feature to review the research report and consider how to adjust the links’ discoverability.
In an October 20 update to its report, Claroc said its research team rechecked 40 shared pages it had previously been able to open without logging in and found that none were still accessible; the associated hostnames returned errors. IT Home noted that the domains and conversation titles already entered into historical passive DNS records still exist, and suspending the sharing feature cannot completely erase those earlier records.
The research team also stressed that its investigation covered only a specific domain pattern and one discovery channel, so the overall scale of exposure of Muse’s shared content cannot be inferred from it. Claroc said there was no evidence that these pages had been maliciously exploited, and it could not determine whether anyone else had accessed the content before the research team discovered it.
Related reading:
“Meta’s AI assistant Muse reportedly can analyze users’ social relationships in depth and create a profile for each contact”
“Meta’s personal agent Muse for macOS reportedly has a serious vulnerability that allows it to be hijacked to control connected apps”