Meta has paused the feature that lets people share conversations from Muse, its personal AI agent. An AI agent is AI that can carry out tasks on its own, such as using apps and websites, instead of only answering questions; Meta says Muse can fill in forms on websites and buy things for people. Meta confirmed the pause on Oct. 20, when asked about research from the security firm Claroc showing that strangers could find shared Muse pages without ever being sent a link. Claroc sells tools that watch what employees share from AI apps. Meta said in a statement that it had paused sharing "while we review this report and consider changes to how these links can be discovered."
When a user asks Muse to share a conversation, Muse publishes it as a web page that opens for anyone with the link, with no login. Claroc says Muse built each page's web address from the conversation's own title, such as a budget or a revenue review, followed by a random code. The first time anyone opens the page, their computer looks up its address, and some services that watch those lookups save the whole address, code included, in records others can search. The code was meant to keep the address impossible to guess, but once it sits in those records, anyone who searches them gets the code too. The researchers had expected gathering the pages to take real effort. "It took one query," they wrote.
Muse launched on Sept. 8. About a month later, one search of such records turned up more than 6,800 share addresses, Claroc says, and its researchers opened only a few hundred. Most of the pages they opened were harmless, such as small-business sites and event calendars. Dozens were not, among them a small-business owner's loan application with the amount requested, a national marketing company's revenue review marked for its chief executive, a to-do list with a bank fraud alert and a partial account number, and a job candidate's notes for a confidential call with a leading AI lab.
Claroc says it reported the problem on Oct. 8 through Meta's bug bounty program. The program pays outsiders who report security flaws, up to $300,000 for a valid report, and Meta opened it to anyone when Muse launched. Claroc's co-founder, Asaf Aprozper, says he got no reply, including when he tried reaching Meta staff on LinkedIn, according to a news report. When Claroc rechecked 40 shares on Oct. 20, none opened, but the addresses, with their titles, are still in those public records.
Claroc says it has no evidence that anyone misused the shares, but it cannot tell how long each page could be reached or whether someone else found it first. Meta has not said when sharing will return.