Meta Muse share links exposed via DNS; sharing paused
Confirmed
The takeaway
On Oct 19, 2026 security firm Claroc reported that links Meta’s Muse agent creates for sharing conversations could be found with a single passive-DNS query, because each link puts the conversation title in a subdomain of cf.metaaiusercontent.com.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 21 October 2026
Your AI and this story
- GPT-6 Astra172 days after its cutoff
- Claude Opus 5.5111 days after its cutoff
- Gemini 4 Argon202 days after its cutoff
- Grok 4.7141 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 111 days before it.
Key facts
- Finder: Claroc (CTO and co-founder Asaf Aprozper); reported via Meta’s bug bounty on Oct 8 with no reply, published Monday Oct 19; Ars Technica (Dan Goodin, Oct 20) got Meta’s response
- Mechanism: share links like ‘loan-application-draft-a4c9e2.cf.metaaiusercontent.com’ put the conversation name in the subdomain; once a recipient opens one, the DNS lookup is logged by commercial passive-DNS services, making links searchable. ‘It took one query’ (Claroc)
- Exposed examples: a candidate’s notes for a confidential executive-search call with a frontier AI lab (contact and meeting time), a company’s internal revenue review, a loan application, a to-do list with a bank fraud alert and partial account number, a real-estate investor’s report with addresses and mortgage figures, a staff vacation calendar
- Meta (to Ars): ‘we’ve paused this functionality while we review this report and consider changes to how these links can be discovered’. Zuckerberg had said in September that Muse was ‘built from the ground up for privacy and security’
- Reach: Hacker News 197 points; The Verge (‘Meta pauses Muse sharing after researchers find AI chats on the web’) and Futurism also covered it. Same day TechCrunch reported Muse passed 10M US downloads in 40 days (Sensor Tower: 10.9M total)
What happened
Claroc found that Muse’s share links, though they include a random string, are discoverable because the readable conversation title sits in the hostname and DNS lookups are recorded by passive-DNS services. After Ars asked, Meta suspended sharing. Read via Ars Technica; the Verge and TechCrunch items are listed from their headlines (Techmeme/sweep).
Why it matters
Agents like Muse are used for work documents and finances, so a small design choice in sharing exposed business secrets at scale, in a product used by over 10 million people.
Sources
3 sources from 3 sites. Numbers match the chips in the text.
3 sources: 3 press
Press
- Ars Technica: Meta Muse exposes users’ personal and business secrets when they share conversationsarstechnica.com, press
- The Verge: Meta pauses Muse sharing after researchers find AI chats on the webtheverge.com, press
- TechCrunch: Meta’s Muse hits 10M US downloads in 40 daystechcrunch.com, press
Changes
- Filed (Futurism, Verge, Hacker News)