What we know so far: Meta has paused the conversation-sharing feature in its Muse AI assistant after security researchers discovered thousands of links in public DNS records. Some of the links exposed sensitive business documents and personal financial information that anyone could access without logging in. Researchers at security firm Claroc traced the exposure to the way Muse generated its web addresses.

Each shared conversation had a hostname containing a descriptive title and a random identifier. Both could appear in searchable DNS records, giving researchers the information they needed to reconstruct the link and open the page.

"People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Muse spokesperson Tracy Clayton said in a statement to The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Sharing tools commonly rely on long, random strings in their URLs to prevent outsiders from guessing an address. Muse used random identifiers that Claroc said were long enough to resist guessing. The weakness lay in where Muse placed them: in the hostname, alongside a title describing the conversation.

Opening a shared page triggered a DNS lookup to resolve the hostname. Passive DNS services can observe and retain these lookups, creating searchable records of hostnames that browsers have requested. In Muse's case, those records preserved each conversation's title alongside its random identifier.

com. After filtering out unrelated scanning activity, the researchers identified more than 6,800 share hostnames.

Source link