Meta Muse's shared-link design exposed thousands of users' private conversations via passive DNS enumeration

Researchers at security firm Claroc enumerated 6,800 share links from Meta's new AI agent Muse using a single passive DNS query, then opened a few hundred to find loan applications, internal revenue reviews, an executive-search candidate's confidential prep notes, and a full-year staff vacation calendar listing dozens of employees by name. The root cause: Muse placed the conversation title inside the subdomain rather than the URL path, meaning every click on a share link wrote a human-readable, searchable record into public DNS infrastructure. "It took one query."

Meta suspended the sharing feature after Ars Technica asked about the findings. The company had launched Muse last month with CEO Mark Zuckerberg describing it as "built from the ground up for privacy and security." Claroc's researcher said he reported the issue through Meta's bug bounty program on October 8 and also messaged Meta contacts on LinkedIn; he received no reply through either channel. This follows a separate incident three weeks after launch in which security researcher Patrick Wardle found a zero-day allowing any co-installed app to take full control of a user's Muse account — notable given that Muse requires access to most of a user's accounts to function.