Meta's Muse AI link-sharing feature reveals personal and corporate data

A security report from cybersecurity firm Claroc reveals that Meta's artificial intelligence (AI) agent, Muse, exposes sensitive personal and corporate secrets through flaws in its web-link sharing mechanism.

Although Meta CEO Mark Zuckerberg previously claimed the platform was designed specifically for privacy and security, Claroc found a structural vulnerability in URL generation that makes public sharing links easy to identify. Using a single query, researchers successfully enumerated 6,800 user-created sharing links.

An inspection of several hundred of these links uncovered confidential data not intended for public view. Compromised material included private executive recruitment notes naming a frontier AI lab contact, a corporate internal revenue review addressed to a company CEO, a small-business loan application detailing requested amounts, bank fraud alerts containing partial account numbers, real estate investment returns with property addresses, and an entire company staff leave calendar.

In response, Meta confirmed that it has suspended the link-sharing feature while it investigates the vulnerability and considers structural alterations to prevent link discovery.

Training Announcement: The BCS Foundation Certificate in AI examines the challenges and risks associated with AI projects, such as those related to privacy, transparency and potential biases in algorithms that could lead to unintended consequences. Explore the role of data, effective risk management strategies, compliance requirements, and ongoing governance of the AI lifecycle and become a certified AI Governance professional. Find out more.