Metas Muse AI leaves users vulnerable to identity theft through simple security flaw with over 6,800 links exposed: report
It’s an AI agent of chaos.Meta’s allegedly ironclad AI assistant Muse sparked privacy concerns after it was caught exposing users’ sensitive and business information.Ahead of the Muse’s release last month, Meta CEO Mark Zuckerberg had stressed the “privacy and security” of the cyber secretary, which executes tasks on the users’ behalf, from sending emails to booking travel, Futurism reported.However, an investigation by security firm Claroc found that the supposedly watertight tech was anything but.The company’s investigators reportedly discovered a glitch that allowed them to access pages from over 6,800 links Muse had created so users could share pages with each other, Ars Technica reported.These included loan applications with the requested amount, bank transaction details, a real estate investor’s internal performance report, and a corporate revenue doc intended for the CEO.There was even a company’s full-year vacation calendar listing the PTO dates of dozens of employees.Worst of all, these secrets were unveiled with the push of a button.
“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote.“It took one query.”To access this intimate info, the investigators reportedly exploited Muse’s share function, which allows users to share searches, conversations, images, and other content among one another.
This content is accessed via AI-generated web links that typically contains a long, cryptic string of characters that theoretically make it hard to hack.However, the Claroc team found Muse’s URLs obvious as they all used the domain name cf.metaaiusercontent.com as well as the AI-generated conversation title alongside the text sequence.Examples included home-sale-budget-9f21c8a3.cf.metaaiusercontent.com and loan-application-draft-a4c9e2.cf.metaaiusercontent.com.“We call these GhostShares: pages that open for people who were never handed the link, and that those peop...