Meta's artificial intelligence agent Muse exposed approximately seven thousand conversations on the internet due to a vulnerability in its sharing feature. The security flaw was identified by the cybersecurity company Claroc and reported to Meta, which subsequently suspended the tool.
Although the URLs were designed to display only snippets of conversations and files, the security weakness allowed access to comprehensive content, ranging from the initial topic of the chat to full pages containing potentially confidential information.
The incident was reported by the Ars Technica portal, which requested an official statement. In response, Meta mentioned that the discovery falls under its Bug Bounty Program and that such occurrences are crucial for product improvement. Mark Zuckerberg's company confirmed it had halted the feature while implementing the necessary adjustments.
Document sharing is a common practice in the digital environment, whether for calendars, texts on platforms like Google Docs, or presentations in PowerPoint. Services like Google Drive generally offer multiple layers of protection, including login and password authentication.
Unlike these services, Meta Muse shared conversations and files in this manner, publishing the interaction as an open page accessible to anyone who possessed the link. Additionally, these pages could be located through a simple title related to the conversation topic, given that the URLs were made available on the public domain cf.metaaiusercontent.com.
Among the leaked data were sensitive documents, such as contracts containing names and values, as well as internal spreadsheets and calendars from real companies. According to Claroc, analyzing just a few hundred of these nearly seven thousand links was enough to demonstrate the magnitude of the problem.
It is relevant to note that Meta had launched Muse emphasizing privacy as a fundamental principle, using exclusive virtual machines for each user, which aimed to prevent the company itself from accessing the interactions.
The alert was sent to Meta on October 8th. The Claroc team reported reviewing the material again on the 18th, at which time new Muse conversation URLs could still be located. In addition to the survey, Claroc also proposed several security measures.
Meta only confirmed the pause on new sharing this Tuesday (10/20), following inquiries from the Ars Technica portal, meaning the functionality remained active for at least 12 days. Currently, Meta Muse is only available in the United States and Canada, with no forecast for launch in other markets, such as Brazil.