Story 1 · the fight
Meta paused Muse sharing after researchers found 6,800 private AI chat URLs in public DNS records
The argument is whether this was a containment failure or a feature shipped without threat modeling, because one requires an incident response and the other requires a design review.
I think this is a containment failure. Meta shipped a share button that generated URLs, researchers scraped DNS, and now we know six thousand conversations were exposed. That is not a feature working as intended.
My read is this was a feature working exactly as designed, and the design was bad. The share button made public URLs. Meta did not say the URLs were breached or accessed without authorization. Calling it a pause instead of a recall tells you they think the feature is fine and the users are the problem.
Where it breaks: Did Meta's system fail to contain data it intended to keep private, or did it successfully share data using a feature that should not have been built?
- Meta pauses Muse sharing after researchers find AI chats on the web · theverge.com“Meta says it paused a Muse feature that lets you share conversations with the AI assistant after researchers found the URLs publicly available on the web”
- Meta pauses Muse sharing after researchers find AI chats on the web · theverge.com“researchers at the security firm Claroc say they found more than 6,800 Muse links through public DNS records”