Ars Technica

Meta’s Muse chat-sharing links exposed in DNS records, with more than 6,800 URLs found

Meta’s personal AI agent Muse has been hit by a privacy flaw that allowed chat-sharing links to be discovered in bulk, according to U.S. cybersecurity firm Claroc. The researchers said a single query of a DNS history database returned more than 6,800 share links tied to Muse conversations. After reviewing several hundred entries, Claroc said it found dozens of sensitive documents, including internal corporate revenue reports, small-business loan applications, and preparation materials for a candidate’s confidential recruiting discussions with a frontier AI lab, complete with internal contacts and meeting times. Claroc said the issue stemmed from Muse’s sharing design. When a user shared a chat, the system generated a public page that did not require login and embedded the chat title and a random ID in the domain. Once opened, the full domain could be logged by third-party DNS services. Claroc reported the issue to Meta on Oct. 8 and published its research on Oct. 18. Meta confirmed it had paused the chat-sharing feature on Oct. 20 after Ars Technica asked about the matter. A same-day recheck found 40 previously accessible links had stopped working, though chat titles remained visible in DNS history records.

Meta’s Muse AI agent exposed by enumerable share links, report says

Meta’s general-purpose AI agent Muse, launched last month, has been found to have a security flaw that may expose user conversations shared through web links. According to researchers at security firm Claroc, the links could be enumerated, allowing outside parties to access content that users likely did not intend to make broadly available. The researchers said they identified 6,800 share links created by Muse users and, after opening hundreds of them, found a large amount of sensitive material, including personal information and business secrets. The disclosure stands in contrast to comments made last month by Meta CEO Mark Zuckerberg, who said Muse was 「built for privacy and security from the ground up」. Ars Technica was cited as the source of the report in the Techub News item.

Meta updates business terms to require AI training access to linked website content

Meta is set to update its business services terms on Oct. 30, adding a requirement that business accounts allow the company to use not only their social media posts but also content from websites linked through those accounts for AI training. According to Ars Technica, businesses will not be able to opt out. If they do not agree, Meta’s stated position is that they should stop using its services. The change is seen as especially significant for news publishers, which may have otherwise sought separate licensing deals for training data worth millions of dollars. The development comes as news organizations are already in legal disputes with OpenAI over whether training AI systems on unlicensed material qualifies as fair use.

360

Meta updates business terms to require AI training access to linked website content