What we know so far: Meta has paused the conversation-sharing feature in its Muse AI assistant after security researchers discovered thousands of links in public DNS records. Some of the links exposed sensitive business documents and personal financial information that anyone could access without logging in. Researchers at security firm Claroc traced the exposure to the way Muse generated its web addresses.
Each shared conversation had a hostname containing a descriptive title and a random identifier. Both could appear in searchable DNS records, giving researchers the information they needed to reconstruct the link and open the page.
"People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Muse spokesperson Tracy Clayton said in a statement to The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."
Sharing tools commonly rely on long, random strings in their URLs to prevent outsiders from guessing an address. Muse used random identifiers that Claroc said were long enough to resist guessing. The weakness lay in where Muse placed them: in the hostname, alongside a title describing the conversation.
Opening a shared page triggered a DNS lookup to resolve the hostname. Passive DNS services can observe and retain these lookups, creating searchable records of hostnames that browsers have requested. In Muse's case, those records preserved each conversation's title alongside its random identifier.
Claroc queried a commercial passive DNS dataset for Muse's content domain, cf.metaaiusercontent.com. After filtering out unrelated scanning activity, the researchers identified more than 6,800 share hostnames. Because the links used the same titles and identifiers recorded in DNS, the team could reconstruct them without guessing. The titles often revealed the subject of a conversation before researchers even opened the page.
Muse's instructions to web crawlers did not prevent the exposure. Its robots.txt file asked search and AI crawlers to avoid the share paths, but those instructions neither restricted access nor stopped DNS services from recording hostnames. The researchers did not need a search engine to discover the conversations.
Claroc inspected a few hundred pages. Most were unremarkable, but some contained material that appeared intended for a limited audience, including a marketing company's revenue review marked for its CEO, a small-business owner's loan application, and a workplace calendar showing employees' vacation schedules.
Other pages included a real estate investor's report containing property addresses, mortgage amounts, income, and returns, as well as preparation notes for a confidential executive-search call with an AI lab. Those notes named an internal contact and specified the meeting time.
Viewing the content generally required only an ordinary browser, not an account. Muse loaded conversations through JavaScript, so a basic page request returned little content. Opening a link in a browser, however, displayed the conversation, including in logged-out incognito sessions tested by Claroc.
The findings have limitations. The total of more than 6,800 represents discovered hostnames, not the number of sensitive conversations. Claroc examined only a few hundred pages and did not contact the people or companies involved, leaving their sharing intentions unconfirmed. The firm also said it found no evidence of misuse and could not establish whether anyone else had discovered the links.
Claroc reported the issue to Meta's bug bounty program on October 8. On October 20, after Meta announced the suspension, researchers retested 40 shares that had previously opened without an account. None remained accessible, and their content hostnames returned errors.
The conversation titles, however, remained in passive DNS history. Suspending the pages blocked access in those tests, but it did not erase the descriptive information already captured in external records. Meta says it is reviewing the findings and considering changes to how shared links can be discovered.,