Muse exposes users' personal and business secrets when they share conversations

> Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,”

> reported the findings through Meta’s bug bounty program on October 8 and also tried reaching people at Meta on LinkedIn, but got no reply either way.

Checks out

> The ease in discovering share links further justifies asking if Muse is worthy of the access it requires.

That's all you could justify?

I couldn't be true. You're telling me that Meta, of all companies, would be careless with user data and privacy? Totally unbelievable!

Lesson here is that the subdomain names can be queried due to passive DNS records, and putting stuff that is not supposed to be guessable in subdomain names is a bad idea.

This is a feature no?

Muse is the most obviously doomed claw-style bot because you already need to segment those things from ANY personal info, and Meta rolls into the room as the journal that will tell everyone what you write in it and says "trust me"

Part of a huge problem with FAANG companies. You can't be Meta and just ratfuck your users for decades and then ask them to trust you, just like you can't be Amazon and turn your storefront into Temu-lite and expect people to want to order products sight unseen with your Echo shit.

I mean, not to victim blame, but anyone willingly using any Facebook product at this point should know what they're signing up for.