A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
A design flaw in Meta's AI tool Muse allowed security researchers to easily discover and access private user share links. The vulnerability exposed sensitive personal and corporate data, including executive search notes and financial reviews, through simple URL enumeration.
Why it matters
This incident highlights ongoing privacy risks in AI platforms, demonstrating how poor URL construction can inadvertently leak highly confidential user conversations and business documents.
Like many online services, Muse has allowed users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in