Muse, Meta’s new general-purpose AI agent, can expose sensitive information when users share conversations via web links, researchers reported Monday.
Like many online services, Muse allows users to share searches, conversations, images, and similar content with other people. Such sharing features typically involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To prevent potentially sensitive information from being accessible to unwanted people, URLs usually contain a long sequence of text that is difficult to guess.
One request is enough
Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” appears to be taking the same precautions. But a central design decision for URL construction made links easy to discover. As a result, researchers at security firm Claroc said they were able to enumerate 6,800 links created by Muse users to share conversations with others. After opening a few hundred, researchers found information that was clearly not intended to be publicly available, including:
- notes from a candidate preparing for a confidential executive search call with a frontier AI lab, naming the lab’s internal contact and meeting time
- internal revenue review of a national marketing company, scored for its CEO
- a small business owner loan application, with the requested amount
- a task list including a bank fraud alert, with a partial account number and transaction amount and time
- an internal performance report of the real estate investor, with two property addresses and exact yield, income and mortgage figures
- a workplace’s staff vacation schedule for the entire year, listing dozens of employees per week for each of them
“If you had asked us in advance, we would have guessed that putting them together would require real effort,” the researchers wrote. “It only took one request.”
The easiest way to discover URLs is to perform a passive DNS lookup through one of the many commercial services available. Passive DNS records store the historical resolution of domain names to IP addresses, as well as records of name servers and mail servers over time. Passive DNS systems typically collect DNS responses from sensors positioned on recursive DNS resolvers or other infrastructure. A passive DNS record is typically created when a monitoring system observes a DNS response. In this case, once the relevant party clicks on the sharing link, the DNS information is saved in a searchable database.
Claroc researchers were able to discover the Muse sharing links because they all use the domain name cf.metaaiusercontent.com. Discovery is further aided by the decision to append the conversation name to the URL, along with a long string of text. Simplified examples of such links are home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com and Loan-application-draft-a4c9e2.cf.metaaiusercontent.com. It is this latter design of including the conversation title in the URL decision that makes public discovery possible.
Gn bussni
