Meta has paused chat-sharing links in Muse, its AI agent app. Security firm Claroc found more than 6,800 shared Muse conversations through public DNS records, without ever being sent the links. If you’ve shared a Muse chat, treat that link as public.
How Muse share links ended up in public DNS
Each shared Muse conversation sits on its own subdomain of cf.metaaiusercontent.com, Ars Technica reports. That hostname contains the conversation’s title plus a random ID. Hostnames aren’t secret, because passive-DNS services and subdomain-discovery tools record and list them.
Claroc says a hostname pulled from DNS is enough to rebuild the full share link. After filtering out the wildcard-DNS noise any domain collects, more than 6,800 share hostnames remained. Ars gives simplified examples like home-sale-budget, q3-revenue-review and loan-application-draft. In other words, the title alone can reveal what a chat is about, before anyone opens it.
What Claroc could read
According to The Verge, Claroc viewed hundreds of the conversations. They included a marketing company’s revenue review and a small business owner’s loan application. Others held a workplace’s full-year staff calendar and notes for a job candidate’s call with an AI lab.
Claroc says it has no evidence that anyone has misused the shares. Its content checks were made on October 7 and 8.
Meta’s response and the timeline
Claroc CTO and co-founder Asaf Aprozper reported the flaw through Meta’s bug bounty on October 8. He told Ars he got no reply, including when he tried LinkedIn. Claroc published its report on October 18 and updated it on October 20.
On October 20, after Ars asked about it, Meta said it was suspending the feature. Muse spokesperson Tracy Clayton gave The Verge this emailed statement, and Meta sent Ars the same line:
“However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.”
The same day, Claroc rechecked 40 shares that had earlier opened without an account. None of them opened. That is a sample, though, not proof that every shared page is gone. Meta’s statement doesn’t say whether share links will return, or whether existing pages have been removed for good.
Unlisted isn’t private
Meta has pitched Muse heavily on privacy since its September 8 launch. Ars notes that Mark Zuckerberg described it as built for privacy and security from the ground up. Yet Claroc and Ars both trace this exposure to one design choice: putting the conversation’s title in a public hostname.
A link you send to one person shouldn’t broadcast its subject to anyone reading DNS records. Until Meta explains what it changes, assume any Muse chat you shared, and its title, could have been seen by others.
Sources: Claroc, Ars Technica, The Verge
