Meta's Muse shared chat links were guessable, exposing over 6,800 pages including a small business loan application

ExtremeTech reports that security firm Claroc found Muse made share links on the domain cf.metaaiusercontent.com, and services that keep records of domain lookups could see the hostnames. Researchers rebuilt working links and found over 6,800 share addresses, including a small business owner's loan application and a real estate investor's internal report with addresses and income. Claroc told Meta's bug bounty on 8 October. Meta said it would suspend chat sharing after Ars Technica asked on 20 October, gave affected pages new URLs, and restored sharing on 22 October.

• Before you share any AI chat or page by link, remove names, addresses, income and client details, because a link is not the same as a private message.
• If you have shared a Muse chat with anything sensitive in it, open Muse and delete it, or ask the person you sent it to for the new link and stop using the old one.

Source: ExtremeTech. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. Image: Meta, from its own announcement. How we source and credit