Muse exposes users' personal and business secrets when they share conversations

Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through web links, researchers reported Monday. In response to questions from Ars about the behavior, Meta said it’s suspending the sharing feature while the company reviews it and considers making changes.

Meta 推出的全新通用人工智能助手 Muse 被研究人员于周一指出，在用户通过网页链接分享对话时，可能会泄露敏感信息。针对 Ars 提出的相关行为质疑，Meta 表示已暂停该分享功能，以便公司进行审查并考虑做出调整。

Like many online services, Muse has allowed users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.

与许多在线服务一样，Muse 此前允许用户与他人分享搜索记录、对话、图片及类似内容。此类分享功能通常涉及点击一个选项以生成唯一 URL，任何拥有该链接的人都可以加载托管相关内容的页面。为了防止潜在的敏感信息被非预期人员访问，这些 URL 通常包含一串难以被轻易猜出的长字符。

Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including:

Meta 首席执行官马克·扎克伯格上个月曾称 Muse 是“从零开始为隐私和安全而构建的”，该产品似乎也采取了同样的预防措施。然而，构建 URL 的一项核心设计决策却使得这些链接极易被发现。因此，安全公司 Claroc 的研究人员表示，他们成功枚举出了 Muse 用户为分享对话而创建的 6,800 个链接。在打开其中数百个链接后，研究人员发现了显然不应公开的信息，包括：

“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”

“如果你事先问我们，我们会猜测收集这些信息需要付出真正的努力，”研究人员写道，“但实际上只用了一次查询。”

In an emailed statement responding to questions from Ars, Meta said: We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product. People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.

在回复 Ars 提问的电子邮件声明中，Meta 表示：我们开启了 Muse 漏洞赏金计划，以便研究人员能够提出不同的场景，帮助我们持续改进产品。用户有能力分享特定的 Muse 内容，这会创建一个可通过链接访问的页面。然而，我们已暂停此功能，以便审查该报告并考虑如何改变这些链接被发现的方式。

Asaf Aprozper, the co-founder and CTO of Claroc, said he reported the findings through Meta’s bug bounty program on October 8 and also tried reaching people at Meta on LinkedIn, but got no reply either way.

Claroc 的联合创始人兼首席技术官 Asaf Aprozper 表示，他于 10 月 8 日通过 Meta 的漏洞赏金计划报告了这些发现，并尝试在 LinkedIn 上联系 Meta 的相关人员，但均未得到回复。

The easiest way to discover the URLs is to perform a passive DNS search through one of many available commercial services. Passive DNS records store the historical resolution of domain names to IP addresses, as well as nameserver, and mail-server records over time. Passive DNS systems typically collect DNS responses from sensors positioned at recursive DNS resolvers or other infrastructure. A passive DNS record is generally created when a monitoring system observes a DNS response. In the case here, once the intended party clicks on the share link, the DNS information is recorded in a searchable database.

发现这些 URL 最简单的方法是通过众多可用的商业服务之一进行被动 DNS 搜索。被动 DNS 记录存储了域名随时间推移解析为 IP 地址的历史记录，以及名称服务器和邮件服务器记录。被动 DNS 系统通常从部署在递归 DNS 解析器或其他基础设施上的传感器收集 DNS 响应。当监控系统观察到 DNS 响应时，通常会创建一条被动 DNS 记录。在本例中，一旦目标方点击分享链接，DNS 信息就会被记录在可搜索的数据库中。

Claroc researchers were able to discover the Muse share links because all of them use the domain name cf.metaaiusercontent.com. Discovery is further made easy by the decision to add the conversation name to the URL, along with a long string of text. Simplified examples of such links are home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, and loan-application-draft-a4c9e2.cf.metaaiusercontent.com. It’s this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible.

Claroc 的研究人员之所以能够发现 Muse 的分享链接，是因为它们全部使用了域名 cf.metaaiusercontent.com。将对话名称连同一长串文本添加到 URL 中的决定，进一步降低了发现难度。此类链接的简化示例如 home-sale-budget-9f21c8a3.cf.metaaiusercontent.com、q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com 以及 loan-application-draft-a4c9e2.cf.metaaiusercontent.com。正是这最后的一项设计决策——将对话标题置于子域名而非 URL 路径中——使得公开发现成为可能。

“Plenty of AI assistants share by public link,” Claroc said. “What makes Muse’s shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search. We call these GhostShares: pages that open for people who were never handed the link, and that those people can find on their own.”

“许多 AI 助手都通过公共链接进行分享，”Claroc 表示，“Muse 的分享之所以容易被发现，是因为标题位于网址内部，公共 DNS 会将其记录下来供任何人搜索。我们将这些称为‘幽灵分享’（GhostShares）：即那些从未被给予链接的人也能打开的页面，而且这些人可以自行找到它们。”

Muse quickly catapulted to one of the top spots in Apple’s App Store. The assistant autonomously fills out forms, books appointments, makes purchases, creates documents, and carries out all kinds of other actions. To work as intended, Muse requires access to most of a user’s accounts. Meta has heavily marketed the assistant as a platform that’s worthy of the extraordinary trust it needs to work as intended.

Muse 迅速跃升至苹果 App Store 的榜首位置。该助手可以自动填写表格、预约、购物、创建文档并执行各种其他操作。为了按预期工作，Muse 需要访问用户的大多数账户。Meta 大力宣传该助手是一个值得用户给予其正常工作所需之非凡信任的平台。

Three weeks after the Muse launch, macOS security expert Patrick Wardle discovered a zero-day vulnerability that allowed any other app installed on the same device to gain complete control of the user’s Muse account. Meta downplayed the severity of the vulnerability on the grounds that exploitation wasn’t possible unless a device was already compromised. The company didn’t acknowledge Wardle’s finding that a simple ClickFix attack was all that was needed to hijack an account. The ease in discovering share links further justifies asking if Muse is worthy of the access it requires.

在 Muse 发布三周后，macOS 安全专家 Patrick Wardle 发现了一个零日漏洞，该漏洞允许安装在同一设备上的任何其他应用程序完全控制用户的 Muse 账户。Meta 以除非设备已被入侵否则无法利用该漏洞为由，淡化了该漏洞的严重性。该公司并未承认 Wardle 的发现，即只需一次简单的 ClickFix 攻击即可劫持账户。分享链接发现的简易性进一步引发了人们的质疑：Muse 是否值得拥有它所要求的访问权限。

With Meta’s suspension of the feature, Muse users no longer face this particular threat, at least for now.

随着 Meta 暂停了该功能，Muse 用户至少目前已不再面临这一特定威胁。