Meta pauses Muse sharing after DNS flaw exposes private chats
Meta just suspended the conversation-sharing feature in its new Muse AI agent after security researchers discovered a flaw that leaked sensitive user chats. Claroc found that Muse embedded chat titles into subdomains, letting anyone harvest 6,800 shared links with a simple passive DNS search—exposing executive notes, revenue figures, and loan applications. Why it matters: It is an embarrassing privacy faceplant for a tool Mark Zuckerberg recently claimed was built from the ground up for security.
Meta CEO Mark Zuckerberg promised just last month that Muse, the company's new general-purpose AI agent, was built from the ground up for privacy and security. It turns out, that promise didn't survive a single web query.
Security firm Claroc revealed on Monday that Muse's conversation-sharing feature was exposing sensitive user data to the public. Meta confirmed it has paused the feature while reviewing the issue.
Most modern platforms generate randomized, unguessable strings for shared links. Muse went a different route: it embedded conversation titles directly into subdomains. That single design choice opened the floodgates.
One query to expose them all
Whenever someone clicked a shared Muse link, recursive DNS resolvers recorded the resolution. Commercial passive DNS services quietly harvested those records into searchable databases.
Claroc researchers said they thought gathering these links would take real effort. Instead, a single passive DNS query returned 6,800 Muse conversation links in seconds.
When researchers clicked through a few hundred of those links, they found a goldmine of sensitive data that was never meant to leave private workspaces.
The findings included executive-search prep notes for an upcoming interview at a frontier AI lab, complete with internal contact names and meeting times. Another link exposed an internal revenue review marked strictly for the CEO of a national marketing agency.
Personal and financial data leaked just as easily. Researchers found a small business loan application showing exact dollar amounts, a bank fraud alert to-do list featuring partial account numbers and transaction stamps, a real estate investor's portfolio with property addresses and mortgage balances, and a full-year staff vacation calendar covering dozens of employees.
Claroc co-founder and CTO Asaf Aprozper said he reported the flaw via Meta's bug bounty portal on October 8 and even reached out to Meta staff on LinkedIn. Meta never answered until Ars Technica knocked on its door.
Why it matters
We think this incident cuts straight through the biggest blind spot in enterprise AI adoption: the illusion of automatic confidentiality.
Users treat general-purpose agents like private chief of staffs, handing them loan requests, unannounced hiring plans, and internal revenue numbers. If you or your team have generated share links on Muse or similar tools, you should assume those URLs are discoverable right now.
Architecturally, Meta made an amateur mistake. Putting readable metadata into subdomains is a known anti-pattern in security because passive DNS scanners scrape them automatically. For a flagship agent touted as privacy-first, skipping this basic threat modeling looks remarkably sloppy.
Just as troubling is Meta's triage pipeline. Sitting on a verified bug bounty submission for nearly two weeks until the press steps in damages user trust far more than the bug itself. It proves that while frontier labs are racing to ship cutting-edge agentic capabilities, classic web engineering hygiene remains their weakest link.
Sources (1)
- arstechnica.com(opens in a new tab)Originalarstechnica.com