All news

Meta Muse's "share conversation" links turned out to be easy to find: researchers located 6,800 other people's chats, and Meta paused the feature

Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .

While an SI assistant gets access to personal accounts, a single flaw in how links are built puts other people's conversations in plain view.

Researchers at the security firm Claroc reported on Monday that the addresses of Muse's shared pages contain the conversation title in the subdomain, and such names end up in public DNS record databases. This let them enumerate 6,800 links created by users; after opening a few hundred of them, according to Ars Technica, they found data that was clearly not meant to be publicly available. Claroc's chief technology officer Asaf Aprozper said he reported the finding through Meta's bug bounty program on October 8 and got no reply. In a statement to Ars Technica, Meta said it has paused the shared-link feature while it reviews the report and considers changes. Last month Mark Zuckerberg described Muse as "built from the ground up for privacy and security."

Sources 1

arstechnica.com
History

Meta Muse agent: launch, growth and risks

19 events
  1. Meta brings back sharing in Muse: published "artifacts" get new addresses after researchers found links through public DNS
  2. Meta Muse's "share conversation" links turned out to be easy to find: researchers located 6,800 other people's chats, and Meta paused the featureOpen now
  3. NYT: Zuckerberg judged the Muse SI agent ready to launch despite the risks
  4. Meta's Muse keeps a file on the user's loved ones and, by its own instructions, obeys the user even against its own safety rules
  5. WSJ: 29-year-old Alexandr Wang has become the face of Meta's SI strategy and boosted the Muse assistant
  6. Meta opens code for DIY devices with its Muse SI agent: from displays to buttons on Raspberry Pi
  7. Apple to tighten app access to all Mac files: SI agents will need explicit permission
  8. Meta's Muse agent gave a buyer a seller's home address on Marketplace, and the buyer showed up at the seller's apartment
  9. Meta launches Muse for Small Business: the agent connects to Shopify, Stripe, Slack, Intuit and Meta ad accounts
  10. Meta opens an enterprise unit around Muse and hires the head of MongoDB to run it
  11. Meta's Muse app is No. 1 on the App Store and Google Play: 3.4 million downloads and audience growth after Connect
  12. Meta at Connect bets on the Muse agent: it is coming to glasses, and a camera-free pair of glasses and the Muse Charm device were also shown
  13. Meta admits Muse is "heavily inspired" by the open agent OpenClaw, down to identical system files
  14. Zero-day vulnerability found in Meta's Muse SI agent for Mac: any app on the computer could take over the agent
  15. Amazon closes its store to Meta's Muse SI agent, while Shopify, by contrast, opens payments to it across all its stores
  16. Meta releases Muse for Mac: an agent that works with your files, email, calendar and messages on its own
  17. SI agents Instinct and Meta Muse learn to call restaurants and clinics on their own
  18. Meta's Muse agent becomes the second most popular app in the US App Store
  19. Meta launches Muse, a personal SI agent that writes emails, books trips and makes purchases on its own
Follow on Telegram