Meta pauses Muse sharing after researchers find private chats
Illustration, not documentary evidence of the event.
Meta has paused Muse’s conversation-sharing feature after researchers discovered links to sensitive user material through searchable DNS records. According to wired.com, republishing reporting originally from Ars Technica, security firm Claroc enumerated 6,800 share links. Researchers opened a few hundred and found material including internal financial reviews, a loan application and an employee vacation calendar.
Meta told Ars it had suspended sharing while reviewing the report and considering changes to link discovery. Claroc cofounder and CTO Asaf Aprozper said he submitted the findings through Meta’s bug bounty program on October 8. The reported findings concern shared material, and do not establish that every Muse conversation was exposed.
The discovery route matters because a hard-to-guess link can still become searchable. Muse placed conversation titles and a random-looking string in subdomains under cf.metaaiusercontent.com. Claroc said passive DNS services could capture those hostnames when intended recipients opened links. These services retain historical DNS observations, giving researchers a way to find addresses without guessing their random components.
For teams that shared work through Muse, this suggests two separate exposure reviews: what the page contained, and what its address revealed. An internal revenue review could expose financial details through the page while its title separately signals the document’s subject. The practical decision is whether an incident involves disclosure of a topic, disclosure of the underlying material, or both. Review the titles and contents of previously shared artifacts separately, then prioritize those containing confidential business information, account details or employee schedules. The researchers’ examples support that triage; they do not establish which other users’ material was accessed.
A redesign should be judged against both problems. Keeping conversation titles out of DNS-visible hostnames would address that discovery route, but would not by itself restrict who can open a shared page. Conversely, restricting page access would not erase titles already captured in historical DNS records. Before treating an earlier sensitive share as contained, establish whether its existing URL still opens for an unintended recipient and whether its hostname disclosed sensitive context. Meta’s pause is a response to the report; it should not be treated as confirmation that previously recorded addresses or accessible pages have disappeared.