Meta Muse exposes users' personal and business secrets when they share conversations
A single query is all that’s required to find thousands of conversations listed by title.
TL;DR
- Meta's Muse AI agent can expose sensitive information through shareable web links.
- Researchers found they could enumerate thousands of Muse share links using a single query.
- Exposed information includes candidate notes, financial reviews, loan applications, and vacation calendars.
- The vulnerability, termed 'GhostShares,' arises from Muse including conversation titles in the URL.
- Passive DNS searches are used to discover these links, which are stored in searchable databases.
- Users are advised to limit personal information in shared conversations and delete links promptly.
- This follows a previous zero-day vulnerability discovery related to Muse's account security.