Meta Pauses AI Assistant Muse Share Feature After DNS Leak Exposes Over 6,800 Chat Links

IT Home reported on October 24 that a privacy risk has been exposed in the conversation sharing feature of Muse, Meta's personal AI assistant. Cybersecurity research team Claroc released a report on October 18 stating that researchers discovered over 6,800 retrievable domain names for Muse sharing pages through passive DNS (pDNS) queries. Some of these pages contained personal financial records, internal corporate documents, and preparation notes for confidential meetings. Meta subsequently suspended the feature, stating that it is investigating the issue and evaluating improvements.

The Claroc research team discovered that Muse generates web addresses based on the titles of conversations shared by users and hosts them under the cf.metaaiusercontent.com domain. Because conversation titles were incorporated into the subdomains, when a user or recipient accessed a shared page, the associated domain name could be logged by passive DNS services, subsequently appearing in searchable historical DNS databases.

Researchers stated that through a single passive DNS query, they discovered hostnames for more than 6,800 shared pages. Claroc then randomly sampled hundreds of pages and found that some contained sensitive information, such as corporate revenue review documents, small business loan applications, bank fraud alerts, real estate investment data, and employee annual leave schedules. Researchers also uncovered preparation materials for a candidate's confidential phone call with the head of a frontier AI lab, which included internal contact details and meeting times.

Claroc pointed out that these pages could be accessed without logging into a Meta account—anyone with the link could view the content. The issue did not stem from attackers cracking randomly generated identifiers; rather, because the full domain names were logged in passive DNS databases, researchers were able to rediscover these shared URLs through queries.

Claroc reported the issue through Meta's bug bounty program on October 8. In response, a Meta spokesperson stated that users could share specific Muse content and generate pages accessible via links; the company has paused this feature to review the research report and consider how to adjust link discoverability.

In an updated report on October 20, Claroc stated that the research team re-examined 40 shared pages that had previously been accessible without logging in, finding that none could be accessed anymore and the associated hostnames returned errors. IT Home noted that the domain names and conversation titles already captured in historical passive DNS records still persist, and pausing the sharing feature cannot completely erase these pre-existing records.

The research team also emphasized that this investigation only covered a specific domain pattern and a single discovery vector, and it should not be used to infer the total scale of exposed Muse shared content. Claroc stated there is no evidence indicating that these pages were exploited maliciously, nor is it possible to determine whether others had accessed the content prior to the research team's discovery.

Related reading: "Meta's AI Assistant Muse Reportedly Capable of Deeply Analyzing Users' Social Relationships and Building Profiles for Every Contact" "Meta's Personal Agent Muse for macOS Exposed to Critical Vulnerability, Allowing Hijacking and Control of Linked Applications"