Meta Muse share links expose users’ personal and business secrets, researchers report
Meta Muse exposes users' personal and business secrets when they share conversations
- Who
- Claroc researchers
- What
- discovered 6,800 Meta Muse conversation sharing links that could expose users' sensitive information
- Quote
As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others.
What happened
Claroc researchers reported that Meta Muse’s conversation sharing links can expose sensitive personal and business information through searchable passive DNS records. They enumerated 6,800 links and found confidential material after opening a few hundred, including internal revenue reviews, loan applications, and employee vacation schedules. The links place conversation titles and a long text string in subdomains of cf.metaaiusercontent.com, allowing discovery through a single passive DNS query.
Why it matters
The passive DNS explanation highlights how sensitive conversation titles placed in share link hostnames can become searchable, offering a concrete design lesson for services that rely on obscure URLs for privacy.
The story so far
Security firm Claroc said researchers discovered 6,800 Meta Muse conversation-sharing links through searchable passive DNS records and found sensitive personal and business information after opening a few hundred of them. The material included internal revenue reviews, loan applications, and employee vacation schedules. Muse’s sharing links place conversation titles and a long text string in subdomains of cf.metaaiusercontent.com. According to the researchers, that structure allowed them to discover the links with a single passive DNS query, exposing conversations users had created links to share with others.
Keep reading
Latest daily · Issue 27TorchNeuron brings native PyTorch support for Hugging Face models on AWS TrainiumTrending now
Tomorrow at 08:00, a briefing like this arrives in your inbox.
The same kind of briefing as the one above: a few stories worth reading. Free. Mail starts after you confirm, and every letter has a one-click unsubscribe. Read a past issue · 2026-10-20