It’s an AI agent of chaos.
Meta’s allegedly ironclad AI assistant Muse sparked privacy concerns after it was caught exposing users’ sensitive and business information.
Ahead of the Muse’s release last month, Meta CEO Mark Zuckerberg had stressed the “privacy and security” of the cyber secretary, which executes tasks on the users’ behalf, from sending emails to booking travel, Futurism reported.
However, an investigation by security firm Claroc found that the supposedly watertight tech was anything but. The company’s investigators reportedly discovered a glitch that allowed them to access pages from over 6,800 links Muse had created so users could share pages with each other, Ars Technica reported.
These included loan applications with the requested amount, bank transaction details, a real estate investor’s internal performance report, and a corporate revenue doc intended for the CEO.
There was even a company’s full-year vacation calendar listing the PTO dates of dozens of employees.
Worst of all, these secrets were unveiled with the push of a button. “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”
To access this intimate info, the investigators reportedly exploited Muse’s share function, which allows users to share searches, conversations, images, and other content among one another.
This content is accessed via AI-generated web links that typically contains a long, cryptic string of characters that theoretically make it hard to hack.
However, the Claroc team found Muse’s URLs obvious as they all used the domain name cf.metaaiusercontent.com as well as the AI-generated conversation title alongside the text sequence.
Examples included home-sale-budget-9f21c8a3.cf.metaaiusercontent.com and loan-application-draft-a4c9e2.cf.metaaiusercontent.com.
“We call these GhostShares: pages that open for people who were never handed the link, and that those people can find on their own,” wrote Claroc.
In light of the oversight, Muse has shut down the feature. “We’ve paused this functionality while we review this report and consider changes to how these links can be discovered,” company reps told Ars in a statement.
However, this wouldn’t be the first time someone has allegedly discovered a privacy-violating glitch in the Meta-verse.
Last week, Meta glasses wearers claimed that the cutting-edge tech specs were listening to them even when set to sleep mode.
“Meta AI does not respond to me, and I never intentionally activated it,” lamented one Redditor. “I have noticed the white notification light activating while I am speaking normally.
