Meta suspended conversation sharing in its new Muse AI agent after researchers demonstrated that user-generated links could expose sensitive data.
The investigation highlighted risks in how conversational AI platforms handle link-based sharing and public discoverability.
The Muse app allows users to share conversations by creating a web link, but security researchers from Claroc discovered that these links could be tracked by third parties.
How the links were found
According to the researchers, the link addresses included titles from the conversations themselves along with additional text, which allowed them to be identified through publicly available online logs. Using search services on these files, the Claroc team was able to find 6.800 links that users had created.
What did the research reveal?
By opening these links, researchers uncovered sensitive information. These included candidate notes for a confidential executive interview, an internal financial audit, a small business loan application, a to-do list with a bank fraud alert, an internal investor performance report, and a workplace vacation schedule.
Meta's reaction
Claroc co-founder and CTO Asaf Aprozper reported the findings to Meta through the bug bounty program on October 8.
READ ALSO
OpenAI invests in company developing brain implant for cancer
In a statement, Meta said it created the program so researchers could flag scenarios and help improve the product. The company added that it had temporarily paused the feature to review the report and consider possible changes.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)