Meta's AI assistant Muse generates unique URLs to let users share conversations.
Security researchers found thousands of these links could be enumerated via passive DNS searches due to predictable naming conventions, exposing confidential documents and internal data.
Muse allows users to share searches, conversations, images, and similar content by creating a unique web link. These links use a specific web address of the service.
How the researchers identified the links
Researchers at Claroc were able to identify 6.800 links that users had created to share their conversations. The discovery was made using a search service in public web traffic logs.
By opening a few hundred of these links, researchers found that they contained personal and professional information that users likely did not want to be public.
READ ALSO
Hackers tampered with old versions of OVHcloud tool to steal data
What kind of data was exposed?
Among the information found was:
- Candidate notes for a confidential executive search call.
- An internal financial review.
- A small business loan application.
- A to-do list that included a bank fraud alert.
- A performance report of a real estate investor.
- An employee leave program.
Why did this happen?
According to the researchers, the publicly searchable nature of these links is due to the fact that the address includes the name of the conversation along with specific text. The findings were published on October 20, 2026 by researcher Dan Goodin.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
