跳到正文
原文
The Verge · AI· Jay Peters·· 11 天前AI 评分49

Meta 修复网址泄露问题并重新开放 Muse 分享功能

Meta turns Muse sharing back on

文章要点
  • 1Meta 修复网址问题后重新开放 Muse 分享功能,称保护用户数据优先
  • 2研究人员称此前能找到营销公司内部营收审查、小企业主贷款申请等 Muse 页面
  • 3Claroc 报告称 Muse 分享网址以对话标题命名并写入公共 DNS
  • 4问题出在 Muse 内文档图片等 artifact 的网址而非聊天分享,旧链接已换新地址
决策要点

Muse 事件的实质是可猜测的公开网址让企业内部内容意外可被搜到,修复方式是整体更换链接而非重构权限。

  • 影响:员工经 AI 工具分享营收审查、贷款申请这类材料可能已外流;此前分享的链接不再直接展示内容,需重新分发;选用 AI 产品时应把分享网址机制纳入数据边界评估。
  • 参考:可考虑排查员工是否曾用 Muse 分享过敏感材料;值得把分享链接的可猜测性和公共 DNS 暴露列入 AI 工具选型测试项;对已换链接的接收方重新分发新地址。
  • 依据:泄露案例与网址机制来自 Claroc 研究人员的报告和媒体转述;问题已修复、分享恢复与换新链接为 Meta 官方口径,暂无独立验证。
正文

Skip to main content

Meta has given new URLs to shared Muse ‘artifacts’ after security researchers reported that public links could be easy to find.

Meta has given new URLs to shared Muse ‘artifacts’ after security researchers reported that public links could be easy to find.

by Jay Peters

Oct 22, 2026, 8:24 PM UTC

STKB394_MUSE_AI_CVIRGINIA_D

STKB394_MUSE_AI_CVIRGINIA_D

Image: The Verge, Getty Images, Meta

Jay Peters

Jay Peters

is a senior reporter covering technology, gaming, and more. He joined The Verge in 2019 after nearly two years at Techmeme.

Meta has re-enabled Muse sharing after security researchers had reported that public conversation links could be easy to find. The researchers said they had been able to find Muse pages like a marketing company’s internal revenue review and a small business owner’s loan application.

Researchers at Claroc reported earlier this week that Muse the web addresses for shared conversations from Muse were named after a conversation’s title and written into public DNS. Ars Technica said Tuesday that Meta paused the sharing feature after it reached out about what was going on.

In a post today on X, Meta’s David Singleton says that “The underlying issue is now fixed, and sharing is back on.” According to Singleton, the issue was with URLs for shared Muse artifacts, which Meta says are things like documents and images inside Muse, and wasn’t a flaw with chat sharing.

“If you shared an artifact before the fix: it now has a new URL,” Singleton says. “Anyone visiting the old link will see a note asking them to get the new one from you. We know that’s a pain, and we’re sorry for the disruption — but protecting user data has to come first.”

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

  • Jay Peters

来源:The Verge · AI · theverge.com