Earlier this month we noted how Meta’s launch of its cutesy agentic AI software Muse arrived with all sorts of major privacy and security screw ups, despite the company’s repeated, breathless claims that privacy and security were at the forefront of the company’s thinking during development.
Like most AI agents, Muse is supposed to help automate simple to moderately complicated daily tasks.
But the app launched with multiple ugly zero-day flaws, one of which let an attacker covertly spy on Mac users. Other flaws were reportedly glossed over and downplayed by a company more interested in rushing to market than ensuring its software actually worked. One person even found you could trick Muse into giving you device root access on the device it’s installed on simply by pretending to be a Muse agent yourself.
Giving Meta (a company with abysmal ethical and privacy standards) massively expanded access to all sorts of personal accounts is just foundationally insane. That was quickly reflected by the people who found the app was accessing people’s private messages without approval, and often ignored all permissions and uploaded them to the cloud – even if you specifically tell it not to.
Outlets like Wired found that Muse consistently creates detailed profiles of all your friends, family, colleagues, “collaborators,” and people you “follow.” Which is “fun” and “cute” when you consider Meta and Mark Zuckerberg’s enthusiastic collaboration with corrupt, surveillance-obsessed authoritarians.
And now Ars Technica has found that Muse can reveal all manner of sensitive personal information when users share conversations through Web links. Like many services, Muse lets users share images, content, searches, and chats with other people via unique URLs. Those URLs generally have long-sequences of text that aren’t supposed to be easily guessed.
But researchers from Claroc found that Meta’s implementation of this feature made it possible for folks to decipher shared content details via a passive DNS search:
“Claroc researchers were able to discover the Muse share links because all of them use the domain name cf.metaaiusercontent.com. Discovery is further made easy by the decision to add the conversation name to the URL, along with a long string of text. Simplified examples of such links are home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, and loan-application-draft-a4c9e2.cf.metaaiusercontent.com. It’s this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible.”
According to the Claroc researchers, some of the data they were able to easily access included:
Meta has suspended the feature while they figure out why they screwed up. Again, this is despite Meta claiming repeatedly in pre-release blog posts that Muse was built with a heavy focus on privacy and security. And again, this is all made possible because Meta doesn’t have to worry about any meaningful accountability in a country too corrupt to pass modern privacy laws, regulate the data broker ecosystem, or hold corporations legally accountable for literally anything.
This is just the orchestra getting warmed up as a parade of half-cooked agentic AI agents rush to market, and people who don’t really understand the scope of what they signed up for connect all sorts of sensitive accounts with Mark Zuckerberg or other sketchy industry titans. Hopefully at least a few market entries can differentiate themselves by not being an ethically dubious pit of public interest malfeasance.
