Meta Muse exposes users' personal and business secrets when they share conversations
摘要
研究人员发现，Meta新推出的通用AI代理Muse在用户通过网页链接分享对话时可能泄露敏感信息。Muse允许用户分享搜索、对话和图片等内容，通常通过生成难以猜测的长URL来防止未授权访问。然而，安全公司Claroc指出，由于URL构造方式的设计问题，链接容易被枚举发现。研究人员枚举了6800个用户创建的分享链接，打开其中数百个后发现明显不应公开的信息。Met
Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through Web links, researchers reported Monday.
Like many online services, Muse allows users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.
A single query is all that's required
Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including:
转载信息
评论 (0)
暂无评论，来留下第一条评论吧