The vulnerability stemmed from how Meta generated web addresses for shared AI interactions. According to Claroc, the URLs were constructed using a combination of the conversation title, a descriptive phrase, and a random ID. Because the hostname often revealed the content of the page before it was even opened, researchers were able to reconstruct full links by querying public DNS directories.
Meta Suspends AI Chat Sharing After Security Flaw Exposed Private Data
Thousands of private conversations with Meta’s Muse AI assistant were rendered accessible to the public after researchers discovered that shared conversation links were easily discoverable through DNS records. Security firm Claroc identified over 6,800 active URLs, prompting the company to disable the sharing feature while they conduct an internal review.
This flaw inadvertently exposed sensitive corporate and personal information. Among the documents uncovered were a marketing firm’s internal revenue review, a small business owner’s loan application, a complete staff calendar for a workplace, and detailed interview notes for a prospective job candidate. Meta spokesperson Tracy Clayton confirmed the temporary suspension of the functionality, stating that the company is currently evaluating how these links can be discovered and secured against unauthorized access.
Comments (0)
No comments yet. Be the first!