Meta’s Muse AI agent, designed for privacy and security, has inadvertently exposed sensitive information when users share conversations via web links. To safeguard your personal data, here are actionable tips and recommendations based on the Muse flaw discovered by security researchers at Claroc. Firstly, it’s crucial to understand the central design flaw that makes these links easy to discover. Muse, like many online services, allows users to share conversations, searches, and other content. The URLs typically contain a long sequence of text that can’t be easily guessed to keep sensitive information from being accessible to unintended people. However, a central design decision for constructing these URLs has made the links easy to discover. Muse users can create a unique URL for sharing conversations, but the domain name used for these links is a key factor in their discoverability. All Muse share links use the domain name cf.metaaiusercontent.com. To protect your conversations, avoid sharing them through these links. If you must share, use a different domain name or a custom URL that is less likely to be discovered. Secondly, consider using a feature that allows you to control who can access shared content. Muse users have the ability to share specific artifacts, which creates a page that can be accessed by those with the link. However, it’s important to review and manage these shared artifacts to ensure they are only accessible to intended recipients. Lastly, if you suspect that your data has been exposed, report the issue to Meta through their bug bounty program. The researchers from Claroc reported the findings and received a response from Meta, indicating that they are taking the issue seriously and are reviewing the report to consider changes to how these links can be discovered. By following these recommendations, you can better safeguard your conversations when sharing with Muse and other AI agents. Remember, the key to protecting your data is to be proactive and vigilant about the links you share and the domains you use for sharing content.
